0c1ddda0f5819ac85497de5400bcfb34474e3d7cd028d043525171cefef256b3

General

Target

21f811f9863e63d2e1a7e9942eea40b8.exe
Size

2.3MB
MD5

21f811f9863e63d2e1a7e9942eea40b8
SHA1

983ba2140521e049615e72c3e7d9d8702f214d83
SHA256

0c1ddda0f5819ac85497de5400bcfb34474e3d7cd028d043525171cefef256b3
SHA512

1ee9789aad428998d2e8c49b69ddf4e94eb6705a555947077fab1cfd56653af47cc726ff920a84b3dfebf6c1641191438b79e1829b156f95e7993acdd48f335c
SSDEEP

49152:UM7DPU7Ku2ocLnbdq6alDLcWLDg3/UnCcxQO8NUQWWxwct1yTnlQT:UVN2DLilMheL5QWWxwct1I2

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll	21f811f9863e63d2e1a7e9942eea40b8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2008	WerFault.exe	27

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2568	PING.EXE
2624	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2008	21f811f9863e63d2e1a7e9942eea40b8.exe
2008	21f811f9863e63d2e1a7e9942eea40b8.exe
2008	21f811f9863e63d2e1a7e9942eea40b8.exe
2008	21f811f9863e63d2e1a7e9942eea40b8.exe
792	21f811f9863e63d2e1a7e9942eea40b8.exe
792	21f811f9863e63d2e1a7e9942eea40b8.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2892	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	30
PID 2008 wrote to memory of 2892	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	30
PID 2008 wrote to memory of 2892	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	30
PID 2008 wrote to memory of 2892	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	30
PID 2008 wrote to memory of 2460	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	33
PID 2008 wrote to memory of 2460	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	33
PID 2008 wrote to memory of 2460	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	33
PID 2008 wrote to memory of 2460	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	33
PID 2008 wrote to memory of 2688	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	34
PID 2008 wrote to memory of 2688	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	34
PID 2008 wrote to memory of 2688	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	34
PID 2008 wrote to memory of 2688	2008	21f811f9863e63d2e1a7e9942eea40b8.exe	34
PID 2892 wrote to memory of 2568	2892	cmd.exe	35
PID 2892 wrote to memory of 2568	2892	cmd.exe	35
PID 2892 wrote to memory of 2568	2892	cmd.exe	35
PID 2892 wrote to memory of 2568	2892	cmd.exe	35
PID 2460 wrote to memory of 2624	2460	cmd.exe	36
PID 2460 wrote to memory of 2624	2460	cmd.exe	36
PID 2460 wrote to memory of 2624	2460	cmd.exe	36
PID 2460 wrote to memory of 2624	2460	cmd.exe	36
PID 2460 wrote to memory of 792	2460	cmd.exe	37
PID 2460 wrote to memory of 792	2460	cmd.exe	37
PID 2460 wrote to memory of 792	2460	cmd.exe	37
PID 2460 wrote to memory of 792	2460	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe
"C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ping 127.0.0.1 /n 300 & "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe" 6
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 /n 300
    3⤵
    - Runs ping.exe
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ping 127.0.0.1 -n 100 & "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe" 5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 100
    3⤵
    - Runs ping.exe
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe
    "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe" 5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 656
  2⤵
  - Program crash
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-20-0x0000000000400000-0x0000000001466000-memory.dmp

Filesize
16.4MB

Download
memory/792-21-0x0000000000400000-0x0000000001466000-memory.dmp

Filesize
16.4MB

Download
memory/2008-0-0x0000000000400000-0x0000000001466000-memory.dmp

Filesize
16.4MB

Download
memory/2008-1-0x0000000000400000-0x0000000001466000-memory.dmp

Filesize
16.4MB

Download
memory/2008-4-0x0000000000400000-0x0000000001466000-memory.dmp

Filesize
16.4MB

Download
memory/2008-8-0x0000000000400000-0x0000000001466000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing