09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c

General

Target
09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
Size 2.0MB
Sample260511-mp52qaay5l
SHA256 09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c
MD5 d7f37cef23ab3d4932598f9ed6a0af2c
SHA1 cca5b50c7b2ce7c0bc30ea9b2cf16b3caeeaf9eb
SHA512 3c1020be2b8acf0cafeef9e9f541278951a35f483e6ac6a94d14d1d84b9001d33d00bd250673c81ecb9e43c3eb36447ec3a9af3440c9201e30642a8a9162e5ec
SSDEEP 49152:TabLsL5aKevWcboBW+8HpiflmSqk0noTB:c4z0oB
TLSH
T1A9A59E13F2E940E8E0BEE57487669636EA72BC460B34A6DF064072551E77FE05B3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\J:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\N:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\S:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\U:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\Y:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\B:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\E:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\K:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\M:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\P:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\V:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\W:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\X:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\G:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\L:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\Q:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\R:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\Z:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\A:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\H:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\O:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened (read-only)	\??\T:	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4680	4364	09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe	88

C:\Users\Admin\AppData\Local\Temp\09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe
"C:\Users\Admin\AppData\Local\Temp\09ece6f149beff9112d6d0b4450ef693a046c99b22b70e8d4a12e3d142bccc2c.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=142.0.7444.176 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1c8,0x198,0x7ff6b8cd29e4,0x7ff6b8cd29f0,0x7ff6b8cd2a00
  2⤵
  PID:4680