e1f803990bc9fd5f000369f7deb247f22c8ee98c5abdb06b4201414fb27dfe88

Analysis

max time kernel
141s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1dfdbcf8e006c7a45c4577f09575615c.exe
Size 1.3MB
Sample231230-11214ahfaq
SHA256 e1f803990bc9fd5f000369f7deb247f22c8ee98c5abdb06b4201414fb27dfe88
MD5 1dfdbcf8e006c7a45c4577f09575615c
SHA1 4b371875c59fc5cf8376cad0dce76b3ef24358d5
SHA512 f900aa648c15ce65f60e607217b0276b4d67196210d153fcca494ab0dce16bc949f98aa84264243447e1036dbabd7f47f3b1a3b922e4ca0c53721ca0ec6a5818
SSDEEP 24576:4DGD444f/3Q+M2pOlZ0vFhmml8hm8h171dQSZEtsG44s3af5lF4sK986umXhcZ:fwVmlytAmy3OS2eGM3aBb46bmxcZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4080	1dfdbcf8e006c7a45c4577f09575615c.exe
4080	1dfdbcf8e006c7a45c4577f09575615c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1dfdbcf8e006c7a45c4577f09575615c.exe
"C:\Users\Admin\AppData\Local\Temp\1dfdbcf8e006c7a45c4577f09575615c.exe"
1⤵
- Loads dropped DLL
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZipDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\ZipDLL.dll
Size 163KB
SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
MD5 2dc35ddcabcb2b24919b9afae4ec3091
SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
SSDEEP 3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsmA598.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsmA598.tmp
Size 340B
SHA256 8cda9c97c4f11540d863ed30c8204ba9415b63b6003e6ffc6d9011a6afa7d344
MD5 cac4525a2ec563eef14f9c6f41c65d03
SHA1 8176b402b6878703000c99062cc1a999c736a8d4
SHA512 3c1331c36dcc3633366ae31b3847f17aa59624b9ca208336607f39aeb9209374103b2023c265637260bda8510555a322cfc79b6c83e12c1de9c036b549122bf1
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b47qywhs.Admin\extensions\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\install.rdf
Size 1KB
SHA256 e045a7cc1eb332289769b1b8a5f3c6fa92cca4a31607e1e86b3b2fc654082618
MD5 0830a5b7b3ff70269e36c7fa1450df32
SHA1 7acb989b1d9c93c71a803f74b0a11e34841b5348
SHA512 0701a75e9c85cd0a8225e0d4c9b632992fc7873f91196f0db6213304f092a6fbb20a664171c1e29300700e96d5031a4299cb847e302428800e5811b88906579c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads