9dbf2efaf1190ae9333fc6226c975dfa4e5769256e8e9345275fbb7415614837 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/10/2024, 20:04

Sharing

Report Analysis Logs

General

Target

2024-10-27_fc8dba5e47798a8a1db8ea2c7867f8b9_snatch.exe
Size

11.4MB
MD5

fc8dba5e47798a8a1db8ea2c7867f8b9
SHA1

f588c1e8450760b22d24141af9e4fd48a06c3c8f
SHA256

9dbf2efaf1190ae9333fc6226c975dfa4e5769256e8e9345275fbb7415614837
SHA512

cd74d78c0131fef90c9be652baa2a9c969117689d1986eb21e7538da0c1b652a7b20e6f4be924f0b730f78042f14d4d98e7d7e7b1ae2dd5aaf80e9fb7fea8034
SSDEEP

98304:Y8DVAGxJez/ZRyNMz3S3H+CnVj32fjUOkBGu7wTu4bSy19Tz2rrI:Y8DO+2/nBz3SHN32fjRkjaXV

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2024-10-27_fc8dba5e47798a8a1db8ea2c7867f8b9_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-27_fc8dba5e47798a8a1db8ea2c7867f8b9_snatch.exe"
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\wLUdi4ACm2\Recent\BlockJoin.xlsx

Filesize
11KB

MD5
6e35700ffef9ed30a6599f7b3509fa8e

SHA1
e4c50f0cb31795d5a81ff9fc829fd8faa2c2f058

SHA256
a0545c6b964fcc716ff84b7d1cce1875e3342686a1f66241ff85e788b6de35aa

SHA512
cd52ac638ac3189b52fd1f3a3b6581aa1669e96973f1d027d550e35a9395bd14383f2feabf8f870304f63173622834ea67f840cff684416dbd692b89153525d3

Download Submit