ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965

General

Target
ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
Size 2.0MB
Sample260503-q2dpsaes3r
SHA256 ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965
MD5 8e3dae57e88b4a2390c7937b33cfd3cf
SHA1 fda813fba80925804041eeea7061eb92061d184a
SHA512 45792dc8af1645db8017aa1ffbac44d1164712a75c152b459cf9dedef325f585973371c59d36add2bf71eb59d82285312c29e448dd757b4d4704e93f31926937
SSDEEP 24576:ihv1ZPswNP/T8aKn3nGovr1Ui6vDSUFbYerOD3RDC+8H4tmGV1Tz0omSRcRRap+X:UdswNXT8aK2vWQboBW+8HpiflmSzw
TLSH
T134A58D13F2E940E8E0BED57487669632EA72BC464B34A6DF068072551E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\I:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\K:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\T:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\V:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\W:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\X:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\Y:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\G:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\Z:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\A:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\J:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\N:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\P:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\Q:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\B:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\E:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\L:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\M:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\O:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\R:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\S:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened (read-only)	\??\U:	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 4368	312	ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe	87

C:\Users\Admin\AppData\Local\Temp\ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe
"C:\Users\Admin\AppData\Local\Temp\ee2f182681982070bf83767cadb3eee78591abdce529117db852efc0f74e9965.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=142.0.7444.176 --initial-client-data=0x1cc,0x1d0,0x1d4,0x1a8,0x1d8,0x7ff75d3729e4,0x7ff75d3729f0,0x7ff75d372a00
  2⤵
  PID:4368