3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5

Analysis

Target

3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe
Size

212KB
MD5

10fdc3ba0c7aafec51f0dbbadc88b2a1
SHA1

9b7e13caec9b334eb9575430ae165362956c5930
SHA256

3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5
SHA512

a4bed2bb7785ded51efb32139fac7d817a5464512f2ddd45257e7bf9cbab71870ee2775a35363df15b98b2c640b54c359e781aadaaa5c1d427e5b21424017eee

Score

7^/10

spyware

Drops startup file 2 IoCs

Processes:

3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vhost.exe	3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vhost.exe	3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe"
1⤵
- Drops startup file
PID:1416

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact