Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 00:24
Behavioral task
behavioral1
Sample
9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe
-
Size
314KB
-
MD5
697a6a433d46c8bdf04cc0f271937300
-
SHA1
afcfec058f1e72196fa66c8dca562387134fc041
-
SHA256
9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520
-
SHA512
f89fa228414b176b4a3e1bde20355b139bbfd345c78c24843886df6960f1c768baf637551af1858d1d47830fd5f69ae090e830129b6332ba1fb389b848d9e348
-
SSDEEP
6144:hgvo5luxSrwwEAVQptNfaPnSxSrkdA0+RnMGhr9wnvJ+8lFnTvMl/4qPDR:OvqlqSrzEAupLiPuSrN0gMa0BlFnLk/T
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1268-55-0x0000000001000000-0x0000000001075000-memory.dmp upx behavioral1/memory/1268-96-0x0000000001000000-0x0000000001075000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\Q: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\S: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\W: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\Y: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\Z: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\F: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\J: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\M: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\N: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\H: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\O: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\T: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\V: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\E: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\G: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\I: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\K: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\L: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\R: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\U: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened (read-only) \??\X: 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File created \??\c:\windows\SysWOW64\searchindexer.vir 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File created \??\c:\windows\SysWOW64\svchost.vir 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File created \??\c:\windows\SysWOW64\dllhost.vir 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File created \??\c:\windows\SysWOW64\msiexec.vir 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\7-Zip\7z.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File created C:\Program Files\7-Zip\Uninstall.vir 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\ehome\ehsched.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C3DE0C1D-6F62-4666-B0A4-030999E76748}.crmlog dllhost.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C3DE0C1D-6F62-4666-B0A4-030999E76748}.crmlog dllhost.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1268 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe Token: SeRestorePrivilege 760 msiexec.exe Token: SeTakeOwnershipPrivilege 760 msiexec.exe Token: SeSecurityPrivilege 760 msiexec.exe Token: SeManageVolumePrivilege 1108 SearchIndexer.exe Token: 33 1108 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1108 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1268 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe 1268 9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe 924 SearchProtocolHost.exe 924 SearchProtocolHost.exe 924 SearchProtocolHost.exe 924 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1108 wrote to memory of 924 1108 SearchIndexer.exe 30 PID 1108 wrote to memory of 924 1108 SearchIndexer.exe 30 PID 1108 wrote to memory of 924 1108 SearchIndexer.exe 30 PID 1108 wrote to memory of 524 1108 SearchIndexer.exe 31 PID 1108 wrote to memory of 524 1108 SearchIndexer.exe 31 PID 1108 wrote to memory of 524 1108 SearchIndexer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe"C:\Users\Admin\AppData\Local\Temp\9dabecb95b3b0c719b70867869feb631546a130282886714fe8773a6e8914520.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1268
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:936
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:760
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:924
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:524
-