41a483806de558a54f5e294d7909b79f7e57fd89a47fde2afb8118188865e126

General

Target
draft3637.exe
Size 15.2MB
Sample261011-phackshf52
SHA256 41a483806de558a54f5e294d7909b79f7e57fd89a47fde2afb8118188865e126
MD5 c8c2cf8b54a8b34a64d9629b2546314b
SHA1 f3be5de6f583f9e22b748a36fb25f679f2830874
SHA512 8f74501a27e6a734b45ed732869a91774659631d3ff97ad98fa7215d44368b9e9161a20d413095f0f991cb6b8b50d9493ce02e1caf713f2e07df8873fec4ea43
SSDEEP 196608:y0c1TBXxD5Gxlrg4TgEu7K4rJ5917HY3edCadGTzlNSTgqZH4DM:yxB/GxlrD4zJrM0QllaH4I
TLSH
T14FF6281010D56607FC3EEFBD89DCB6444F7AB6A53722EA385B410AE94FD1F18C8429A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 2892	2380	draft3637.exe	96

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2380 wrote to memory of 2892	2380	draft3637.exe	96
PID 2892 wrote to memory of 3916	2892	RegAsm.exe	97
PID 2892 wrote to memory of 3916	2892	RegAsm.exe	97
PID 2892 wrote to memory of 4304	2892	RegAsm.exe	98
PID 2892 wrote to memory of 4304	2892	RegAsm.exe	98
PID 2892 wrote to memory of 4948	2892	RegAsm.exe	99
PID 2892 wrote to memory of 4948	2892	RegAsm.exe	99

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4156