06513f1517419cea31daa73ceb9ff9fbe6ffaa8bdd66d7e3af95b84c377c546a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x000600000001413d-159.exe
Size

4.6MB
MD5

a026d536a303ffb878a59e3fbecfa54f
SHA1

adec7d1bbbeb0165cc8467be53fd150a4a518c53
SHA256

06513f1517419cea31daa73ceb9ff9fbe6ffaa8bdd66d7e3af95b84c377c546a
SHA512

841b9296d45b0663a6673861520e0c903e4c891b2a8b2f5ecfb9b2af14278cc708d3fd2183d34168263470f88936d27ba9dbc0b8463bd8537b14ece5c54f97ed
SSDEEP

98304:yoR2I5wqk0BAX3yRx31gjqpSTZZpzGcyn4OiZrq1DfPHNADtV6v+D:5/lSZpzGp4O7NADtV6v+

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2840	0x000600000001413d-159.exe

C:\Users\Admin\AppData\Local\Temp\0x000600000001413d-159.exe
"C:\Users\Admin\AppData\Local\Temp\0x000600000001413d-159.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-2-0x00000000022D0000-0x00000000022E0000-memory.dmp

Filesize
64KB

Download
memory/2840-8-0x00000000024F0000-0x0000000002500000-memory.dmp

Filesize
64KB

Download