089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:40

Target

089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe
Size

9.0MB
MD5

09e6ae2eb205863d24b3bbf78b899499
SHA1

721467de92529acb1721e12a6a53ebb599a79a57
SHA256

089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3
SHA512

57813bf9992a91ca00b37e6e1c0d1087b3b6e22af5767e81b98bbe855fb7a84a94825b80deef37415feeb63b81636a0e580bd701983c04cbcd1a389fdee4ae59
SSDEEP

196608:nMJcDKlFBqZcPzFwDxURK8vyqByLdlf3hRQIgLKN:MODKlFBqauayOclfhRQIG2

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe

pid process

2460 089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe
2460 089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe

pid	process
2460	089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe
2460	089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe

C:\Users\Admin\AppData\Local\Temp\089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe
"C:\Users\Admin\AppData\Local\Temp\089071cb470daf205e4006e280aed6ea9e81105c4b350a8abdc2d86e543b4dc3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2460

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance