1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd

General

Target
1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
Size 2.0MB
Sample260510-ktthdafs8m
SHA256 1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd
MD5 daa0343b8a2eecea56247d3811b36729
SHA1 65840c58e635497d65a0f9b9b774899f470640a4
SHA512 cf77e240e53b30824f49459994d153eddd1b2b7647a101dfde69e85c549866b1bb980d4c40f5a4960154ea7fde9c4d7fa458cb52f062b574f17ac2aee955f9f2
SSDEEP 24576:PFvJ6IKxn4VTfaAx+nTiMEr1U96vDSUfbYerOD3RDC+8H4tmGV1Tz0omSIdxqZ:H6hxnITfaAS8vWCboBW+8HpiflmSIC
TLSH
T183A59D13F2E940E8E0BEE57887669632EA72BC454B34A6DF064072551E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\M:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\P:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\Q:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\V:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\Z:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\B:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\I:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\K:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\T:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\A:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\H:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\J:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\O:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\R:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\U:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\W:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\Y:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\G:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\L:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\N:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\S:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened (read-only)	\??\X:	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 564	1456	1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe	88

C:\Users\Admin\AppData\Local\Temp\1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe
"C:\Users\Admin\AppData\Local\Temp\1a1749f2ae4eb7a556543d1b865e9eb18f049b10aaad42e6a77e4ea7c9aeddcd.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=142.0.7444.176 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1bc,0x1ec,0x7ff663d929e4,0x7ff663d929f0,0x7ff663d92a00
  2⤵
  PID:564