03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96

General

Target
03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
Size 2.0MB
Sample260504-w9mkjsax2x
SHA256 03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96
MD5 dc918c752380feedd84caced7e0e0062
SHA1 43fb41f93282f4c719b4ddad7d7ff4e6417df2bf
SHA512 dd4b9258c5f81f1c54ea29b0598443a6071de56c9dddb2e286de8a69bf05f63a7690b19ab3ee2a93edc96d969f8ca84b4d0142283941469cbef5458bf6b10ac3
SSDEEP 49152:mP0mLRLwaxMvWqboBW+8HpiflmS1kmHj0y:M04y+/
TLSH
T12EA58D13F2E940E8E0BED57487669632EA72BC464B34A6DF064072951E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\R:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\S:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\U:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\A:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\G:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\L:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\T:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\V:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\Z:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\M:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\P:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\W:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\X:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\Y:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\B:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\J:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\N:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\Q:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\E:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\H:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\I:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened (read-only)	\??\K:	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2952	5068	03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe	89

C:\Users\Admin\AppData\Local\Temp\03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe
"C:\Users\Admin\AppData\Local\Temp\03fa09e28fe38ca6f1e3e2a6c9d1076f76d6637e70523ffeb73d37e11f511c96.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=142.0.7444.176 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1bc,0x1ec,0x7ff714ba29e4,0x7ff714ba29f0,0x7ff714ba2a00
  2⤵
  PID:2952