Analysis
-
max time kernel
16s -
max time network
50s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-08-2021 17:12
Static task
static1
Behavioral task
behavioral1
Sample
ChromeRecovery.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ChromeRecovery.exe
Resource
win10v20210410
General
-
Target
ChromeRecovery.exe
-
Size
67KB
-
MD5
b3d0b8c065ad75dfd646829bc7c87735
-
SHA1
629655f03b356ad46ae106855eb004c7be7098c0
-
SHA256
61560f470822a249950e3d35574aae0ee9c93da31c1fd6f001c0cec97069a4fb
-
SHA512
81539089391fb7aad33450a37ab57ec4a13c544a70ead868bc89f4e5d3d81dd948b4ea82c9ba1a780e03dfee608839b6acf2868f0ff6c0fc0fd2ef2fd6cf766e
Malware Config
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
A310logger Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe a310logger C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe a310logger -
Executes dropped EXE 1 IoCs
Processes:
MZ.exepid process 556 MZ.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ChromeRecovery.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 ChromeRecovery.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ChromeRecovery.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MZ.exepid process 556 MZ.exe 556 MZ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MZ.exedescription pid process Token: SeDebugPrivilege 556 MZ.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ChromeRecovery.exedescription pid process target process PID 1840 wrote to memory of 556 1840 ChromeRecovery.exe MZ.exe PID 1840 wrote to memory of 556 1840 ChromeRecovery.exe MZ.exe PID 1840 wrote to memory of 556 1840 ChromeRecovery.exe MZ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChromeRecovery.exe"C:\Users\Admin\AppData\Local\Temp\ChromeRecovery.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exeMD5
1bad0cbd09b05a21157d8255dc801778
SHA1ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA5124fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exeMD5
1bad0cbd09b05a21157d8255dc801778
SHA1ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA5124fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533
-
memory/556-62-0x0000000000000000-mapping.dmp
-
memory/556-65-0x0000000001F30000-0x0000000001F32000-memory.dmpFilesize
8KB
-
memory/1840-60-0x0000000000BE0000-0x0000000000BE2000-memory.dmpFilesize
8KB
-
memory/1840-61-0x0000000000BE6000-0x0000000000C05000-memory.dmpFilesize
124KB