7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe
Size

648KB
MD5

993077fad9d5dd79b70d18f348b9b20d
SHA1

740a1df09e85f60e86722ec939df2874d63ba2e0
SHA256

7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff
SHA512

1688bd7baea5dbcb2c7e42269911e7295b359d640e28e96d8d906f585b5218430e8713133663f63676ef791eaa53b2da92b3efee3dbcd623c25c4ee40605d42b
SSDEEP

1536:yzvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqiIzmd:JSHIG6mQwGmfOQd8YhY0/E/UG

Score

7^/10

collection spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe

C:\Users\Admin\AppData\Local\Temp\7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe
"C:\Users\Admin\AppData\Local\Temp\7b49315a07d92562008785f18022b53b380f999abe92a6d4014c014461660dff.exe"
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads