b8c91d6c70ac6045598ed631b2afde348cf96af0b6a015bb6191947b4d782798

General

Target
loader.exe
Size 10.5MB
Sample261003-ss86fatsds
SHA256 b8c91d6c70ac6045598ed631b2afde348cf96af0b6a015bb6191947b4d782798
MD5 e96a374fa3f8581bbe4a3fd6df4699ff
SHA1 eb6ced6d4444cafa1b65186662616694e320edbc
SHA512 fab600580a8b18807bfd126ce11549095daf5384a34c3f4ce5a35879843c137becbcb237098ef33f5a7b45112a20132b622400b7aeda70ac7702628d6a12a418
SSDEEP 98304:9PasP1GAaybBDSeTpC/nxs200wjFMvCE:9Ld9Q+2DWCvP
TLSH
T129B64947ECA555E4C0ADC17ACA669557BB713C894B2063D32BA0F7242F37BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3356	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1600	loader.exe
1600	loader.exe
1600	loader.exe
1600	loader.exe
1600	loader.exe
1600	loader.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4136	chrome.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3356	1600	loader.exe	89
PID 1600 wrote to memory of 4136	1600	loader.exe	91
PID 1600 wrote to memory of 4136	1600	loader.exe	91
PID 4136 wrote to memory of 4616	4136	chrome.exe	92
PID 4136 wrote to memory of 2528	4136	chrome.exe	95
PID 4136 wrote to memory of 2868	4136	chrome.exe	96
PID 4136 wrote to memory of 3060	4136	chrome.exe	97

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\loader.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4136240721640 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4136240721640\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4136240721640 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1b8,0x1bc,0x1c0,0x194,0x1c4,0x7ffc0ecdc728,0x7ffc0ecdc734,0x7ffc0ecdc740
    3⤵
    PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4136240721640" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1692,i,6298162010070537606,15103301843774091446,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:2528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4136240721640" --force-high-res-timeticks=disabled --field-trial-handle=1692,i,6298162010070537606,15103301843774091446,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4136240721640" --force-high-res-timeticks=disabled --field-trial-handle=1692,i,6298162010070537606,15103301843774091446,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
    3⤵
    PID:3060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.bat

Path C:\Users\Admin\AppData\Local\Temp\loader.bat
Size 2KB
SHA256 9b2020ee466e6607de9800de66ba697cf1fe05a2481a1e2f0ad2fa4671fd0a96
MD5 1387e2e9c2955901f5cf052d8908bc76
SHA1 98b451f350839c207918caa802cd6d6f7bbe2df4
SHA512 0b153cb744ec65d11b94e50054c6f6f1b078ceafceb47978e95e4575ea241d3620ec2a6d499715476749bd0f049c5585e02a0ec2c44b1c3745ac221c7d0b6924
TLSH
T18141CB07F0265322F0956193AD3071DA3B22664FD64A9CEC718F4436E284BE0B3BE994
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing