040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4

General

Target
040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
Size 2.0MB
Sample260507-srce3sft3y
SHA256 040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4
MD5 36d76ee9da76f29dc01d0be921c860ce
SHA1 69c23182575a4af0cd0fa16aa730462d3aed0c9c
SHA512 ce8378454d92c0178a79b7bed73f40ad09cd2bd55917a638a2c09d68506789cc7392004001fd0c84548467122a24ee59a6a9c2260897893718d3935c476072ab
SSDEEP 49152:dy956JiaSrkvWaboBW+8HpiflmSQ8JhO4:ia4Q8r1
TLSH
T17BA58D13F2E940E8E0BAE57487669632EA72BC454F34A6DF064072951E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\E:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\H:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\J:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\S:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\U:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\X:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\Y:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\A:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\G:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\K:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\V:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\W:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\Z:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\B:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\I:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\N:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\O:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\P:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\R:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\T:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\L:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened (read-only)	\??\M:	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 5588	704	040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe	85

C:\Users\Admin\AppData\Local\Temp\040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe
"C:\Users\Admin\AppData\Local\Temp\040d99e7fb26c07a803b08793d145945dabe28320576f8cbff99d954d5a67cb4.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=142.0.7444.176 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1bc,0x1ec,0x7ff7a1d429e4,0x7ff7a1d429f0,0x7ff7a1d42a00
  2⤵
  PID:5588