37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc

General

Target
37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
Size 2.0MB
Sample260510-ywt4kshx2l
SHA256 37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc
MD5 87985cf80313d2ea2597a8cf5fddb97c
SHA1 270463560519834164f6308026794f3ef9ab2f7c
SHA512 c31f19c21cfcb75482f85c44a7b24ce7dae17831ff7827cb87aafe1fc822e5a246f050717c0b25d18d75ddeec10555c6da4111c9815f12475a0af36d81087189
SSDEEP 24576:NVv7HQ7nCS+qAanzVwBber1Uo6vDSU9bYerOD3RDC+8H4tmGV1Tz0omSR5HAGax:7w7nCBqAanEvWAboBW+8HpiflmSnAGU
TLSH
T177A58D13F2E940E8E0BED57887669636EA72BC460B34A6DF064072551E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\X:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\Y:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\G:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\I:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\N:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\P:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\Q:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\E:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\J:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\K:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\L:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\M:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\U:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\A:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\B:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\O:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\T:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\V:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\Z:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\H:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\R:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened (read-only)	\??\S:	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 4292	332	37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe	89

C:\Users\Admin\AppData\Local\Temp\37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe
"C:\Users\Admin\AppData\Local\Temp\37d4addacce457c6e16380cbca32a683cfade9384b526c963aa8b5d017102fcc.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=142.0.7444.176 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1a8,0x1ec,0x7ff6e39929e4,0x7ff6e39929f0,0x7ff6e3992a00
  2⤵
  PID:4292