3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5 | Triage

Analysis

max time kernel
149s
max time network
7s
platform
windows7_x64
resource
win7v200430
submitted
20/07/2020, 19:20

Sharing

Report Analysis Logs

General

Target

3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe
Size

212KB
MD5

10fdc3ba0c7aafec51f0dbbadc88b2a1
SHA1

9b7e13caec9b334eb9575430ae165362956c5930
SHA256

3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5
SHA512

a4bed2bb7785ded51efb32139fac7d817a5464512f2ddd45257e7bf9cbab71870ee2775a35363df15b98b2c640b54c359e781aadaaa5c1d427e5b21424017eee

Score

7^/10

spyware

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vhost.exe	3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vhost.exe	3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3786ad08d8dacfa84a0c57b48dfa8921435f5579235d17edc00160e7a86ae1c5.bin.exe"
1⤵
- Drops startup file
PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads