210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a.exe
Size

7.2MB
MD5

4162e612cc93fca908eee344cfde5f47
SHA1

895517395a882c0af8cfea9b012a3213d512a480
SHA256

210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a
SHA512

47e28960d27ff7972d78d0d9e0aba986db6504ddbe1851355ede4048d25b0101a4f35c02eea66e062cd9e639b89497077d529fad3fff595d343e27e7ea8bc0b0
SSDEEP

196608:9DBJcDKlFBqhRK85Xs5XvyCMYpr/nGLtwN:ZBODKlFBq7XsBvyCpLGLtw

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a.exe
2540	210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a.exe

C:\Users\Admin\AppData\Local\Temp\210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a.exe
"C:\Users\Admin\AppData\Local\Temp\210927ca989ea663b6f371bdba164f268216b47322e0c30175af361468e5151a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...