e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1

General

Target

e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
Size

7.9MB
MD5

15ada4e1464b3b335dcd53c7a5442b98
SHA1

0096fcc5962493999f04cc18fcd0c480a0bfef82
SHA256

e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1
SHA512

5df7cb278b4832cd25d13c4582240373995cdd7e72b6af8445a3a319f2d7be72206b5cab30f0aac8562f1ae81e76d7da4e614ee2076ea70a5fef4b24f554a1ba
SSDEEP

24576:JNFO4eYFAvUgRXUwsmKmsTUr+u90D5CD43v47UfrB51vFX091GTjAZw4aGvRHkK7:6q

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3092 set thread context of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1936	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	81
PID 3092 wrote to memory of 1936	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	81
PID 3092 wrote to memory of 2956	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	82
PID 3092 wrote to memory of 2956	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	82
PID 3092 wrote to memory of 4964	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	83
PID 3092 wrote to memory of 4964	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	83
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3092 wrote to memory of 3980	3092	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	84
PID 3980 wrote to memory of 4560	3980	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	85
PID 3980 wrote to memory of 4560	3980	e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe	85

C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
"C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  2⤵
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "del C:\Users\Admin\AppData\Local\Temp\e918bb058ef4042a3e4f535ebaa8e5bc3dd6d3ff3c5f81e93b0f3f2915a098c1.exe"
    3⤵
    PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3092-0-0x0000000000C70000-0x000000000144A000-memory.dmp

Filesize
7.9MB

Download
memory/3092-1-0x00007FFCB4E10000-0x00007FFCB58D2000-memory.dmp

Filesize
10.8MB

Download
memory/3092-2-0x000000001D370000-0x000000001D74A000-memory.dmp

Filesize
3.9MB

Download
memory/3092-3-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/3092-4-0x000000001EB90000-0x000000001EC22000-memory.dmp

Filesize
584KB

Download
memory/3092-5-0x000000001F6D0000-0x000000001F6F2000-memory.dmp

Filesize
136KB

Download
memory/3092-11-0x00007FFCB4E10000-0x00007FFCB58D2000-memory.dmp

Filesize
10.8MB

Download
memory/3980-7-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/3980-10-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/3980-14-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/3980-15-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download

Analysis

Sharing