8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 05:22

Target

8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe
Size

7.2MB
MD5

a750ca94ac33acf6eb547d63612dcc92
SHA1

c24819f6ae3e190147f2221da4f5f849be51827a
SHA256

8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51
SHA512

1f586d7a1a5089aa3a9f8385ebab66b9192e2c9e99b50e1977076d8226f91249723dfc50789b3c5bb64d42acca0a44e06d964de50d03e57cd48ddf72a9d3c106
SSDEEP

196608:9DYJcDKlFBqhRK85Xs5XvyCMYpr/nGLtwN:ZYODKlFBq7XsBvyCpLGLtw

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe

pid process

4708 8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe
4708 8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe

pid	process
4708	8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe
4708	8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe

C:\Users\Admin\AppData\Local\Temp\8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe
"C:\Users\Admin\AppData\Local\Temp\8863f4d42a7b21b25aabede0cda323fa9213062d48a47a57ef97c5db38260f51.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance