Extracted

• • Target
    rk9903c4521.hta
  • Size 33KB
  • SHA256 658373bc16ba781e7ffa8ed7c7e8f2cca89d6b2c0b9bcb62d1c48db970abcf67
  • MD5 43cf36fab647af0aaddb74c9cb278b40
  • SHA1 7352b8eb2ce97e7be6c28a5d8a43d0c32ac96ded
  • SHA512 467a730bdf98508d97dde40ad51a43959d7ffbbdecfced4b5f483acf26cea9373b6a1201c4a058adce74f1cad0b94c074f1c7539c3688739b0405544c91af080
  • SSDEEP 96:VTp7P2HtFJYPt9BFfB1Xuk/9xrToLdC6blOkaF491:FpyHtW1XukFxrT97Fi
  • TLSH
    T1C2E2863DDDACC96D4BE8B8EC78913322DDB5054257C19CBE5C1AA7D8EEAC215623C107
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2