18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300.exe
Size

2.1MB
MD5

02961c08b4e188b394404b9045550c32
SHA1

25dbda018d0d16db68457873309fd29dcad8f99e
SHA256

18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300
SHA512

273cfaf983a602cca61923f05165555898aa99814939505fcf15cb3a01ae601b709f358eb06013aefafde2cc17c6f4b1ea323fdd4318daa6ccb339a7c27708fb
SSDEEP

49152:h1Os0r4lSVHMdhSEM+5Rz8yH+zzBuTivFk:h1ORxchSEP7jMzkiv+

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4772	hhSHRnwYJJhp9XX.exe

Loads dropped DLL 3 IoCs

pid	Process
4772	hhSHRnwYJJhp9XX.exe
396	regsvr32.exe
2024	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehalnfeamlkklmccceghmeegkdpbddo\2.0\manifest.json	hhSHRnwYJJhp9XX.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehalnfeamlkklmccceghmeegkdpbddo\2.0\manifest.json	hhSHRnwYJJhp9XX.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehalnfeamlkklmccceghmeegkdpbddo\2.0\manifest.json	hhSHRnwYJJhp9XX.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehalnfeamlkklmccceghmeegkdpbddo\2.0\manifest.json	hhSHRnwYJJhp9XX.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehalnfeamlkklmccceghmeegkdpbddo\2.0\manifest.json	hhSHRnwYJJhp9XX.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	hhSHRnwYJJhp9XX.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	hhSHRnwYJJhp9XX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	hhSHRnwYJJhp9XX.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	hhSHRnwYJJhp9XX.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.dat	hhSHRnwYJJhp9XX.exe
File created	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll	hhSHRnwYJJhp9XX.exe
File opened for modification	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll	hhSHRnwYJJhp9XX.exe
File created	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.dll	hhSHRnwYJJhp9XX.exe
File opened for modification	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.dll	hhSHRnwYJJhp9XX.exe
File created	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.tlb	hhSHRnwYJJhp9XX.exe
File opened for modification	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.tlb	hhSHRnwYJJhp9XX.exe
File created	C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.dat	hhSHRnwYJJhp9XX.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4772	4960	18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300.exe	80
PID 4960 wrote to memory of 4772	4960	18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300.exe	80
PID 4960 wrote to memory of 4772	4960	18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300.exe	80
PID 4772 wrote to memory of 396	4772	hhSHRnwYJJhp9XX.exe	81
PID 4772 wrote to memory of 396	4772	hhSHRnwYJJhp9XX.exe	81
PID 4772 wrote to memory of 396	4772	hhSHRnwYJJhp9XX.exe	81
PID 396 wrote to memory of 2024	396	regsvr32.exe	82
PID 396 wrote to memory of 2024	396	regsvr32.exe	82

C:\Users\Admin\AppData\Local\Temp\18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300.exe
"C:\Users\Admin\AppData\Local\Temp\18928ced3932a007713c032f73a5492c38636b9576d7d8fbc7ee24a970deb300.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\hhSHRnwYJJhp9XX.exe
  .\hhSHRnwYJJhp9XX.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.dat

Filesize
6KB

MD5
9e258b6e4296fc01e72cbe337400d5f1

SHA1
5e2236e71c5c0195da4f92b6c70860fb01ea3617

SHA256
7ebf7260148dc15b3a972565ff52b7e300cfe074f7a2f0dfa15a88bec213b42d

SHA512
34792ffea777954d7c20b9ba9cc013c4b797d28ab17cf3d45afd08dc73981b08d1681265f7f16be09c1d90c127b3d5445902cad70fb1dc314306b82b4388598b

Download Submit
C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.dll

Filesize
616KB

MD5
e9332601d3a49395156fc2a68bc9e0fc

SHA1
93d0a64766f13c64961cc095e29265c141277a5e

SHA256
2f1487ddd10c7ae59ed3abeb50382e5733a6aed9def3f227f2e5641f0ede7da0

SHA512
5c70de3057f145db98c007ee0b4b9e6cec57ef81c660c85ed5fb39384a8dbdae665eb1ba34c486a648f5d93e526c850e7e2dfa496c5471ff710dd7d559c46ad6

Download Submit
C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Program Files (x86)\CosTmin\TLQMfAOem9U6bQ.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
318cfe8b6b399946b3fab10995d20554

SHA1
6a3df709a3dcbc86f27096ee0c824244925eba93

SHA256
9f832cd340fa12027389ad2d01120f403c689093ea0124fc7e7cfd5bda7b4067

SHA512
4288134977538b488e1cdcacaf9cddea083e1d96f47845e02bb4de67a0f3dba89a1b3dfacde65ca16e0a8a92dac5300d4cd9782f142fcbbcb3fc9caf97974af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
71cac116e606959030cc23a650f9ba35

SHA1
67f5c2ec115e514bd65ab1f225aba029f3adf84f

SHA256
5a59f789ec8aa73d0da7d7d690ecc48efca2f91a85e91b41dae49ac5a8710d49

SHA512
0982fd5671f880ebeb771851c300ccaffd3be4ee1667c74e541fdebf33cb0c6a6a4321d2e83a386b7887f96327074dc77e9596645384d089ad3d0c2eeb660458

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\[email protected]\install.rdf

Filesize
599B

MD5
c181214423ba6c06ff8f75ce466a00a4

SHA1
fbc9161d07007645e4f7539a691bd480cb223a6c

SHA256
148c49846cb9cc542a66d62a37840a4913aaa765564a5daa16f2d549bfe2d748

SHA512
508662c905311ca1b21267bb29595d95db9ce5faf268154a945b5f3cbcd2309fd3fd4968900e81f5844fb503eb52efa27c26742313c90b8f012f381b744fb5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\TLQMfAOem9U6bQ.dll

Filesize
616KB

MD5
e9332601d3a49395156fc2a68bc9e0fc

SHA1
93d0a64766f13c64961cc095e29265c141277a5e

SHA256
2f1487ddd10c7ae59ed3abeb50382e5733a6aed9def3f227f2e5641f0ede7da0

SHA512
5c70de3057f145db98c007ee0b4b9e6cec57ef81c660c85ed5fb39384a8dbdae665eb1ba34c486a648f5d93e526c850e7e2dfa496c5471ff710dd7d559c46ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\TLQMfAOem9U6bQ.tlb

Filesize
3KB

MD5
eec93149067789c941497138f5422741

SHA1
aad1991b9b8f568255707de7a0d101115dc65501

SHA256
63f49ab03606822625fec5331ed40e271577b245b720e22d051212d6936d7d55

SHA512
969517f1d3e4360787a9919c0a78694a932bfc911127959ac345864faf77d5526e3ddf8ebb31d56f9b2a859f45eae192f274f68374267c1eb6c64368d204f4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\TLQMfAOem9U6bQ.x64.dll

Filesize
695KB

MD5
132599fbce10c08be6ebec9473a27d9e

SHA1
03932abc447bdee8dc565f28a05ff0d37352c761

SHA256
3933d02d30adfac55b4505e50a1a484a3a4c1cd6413496b4973befaef2aab2a9

SHA512
f150803390cd35dffb1cfbf9fd703d845598dd3d029b5ced7cbd2d60cfbe2a467f0e3585b592549796724238b40a7b0251c38f351e6e10b3384a452da323f89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\cehalnfeamlkklmccceghmeegkdpbddo\ZizF0C.js

Filesize
5KB

MD5
b29c04a8ebda21b0efebb2be61c3932b

SHA1
f82eb1abdeb277e9df3372a775d16ed84a16f735

SHA256
7e09af4cc47d9679f6fbe3142757401804f43eaa3844e1aaefa7edd5099452d2

SHA512
a54e12f9a3224c7e9117d1e874ac94a34641710e692fefef63da54acf44a772279963c28b384e67d512a11a73008d215f60c90f1cf0cb863caf72b1b8ac8e472

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\cehalnfeamlkklmccceghmeegkdpbddo\background.html

Filesize
143B

MD5
3528eb80ae4eb04e3560995bf06af7ac

SHA1
aeb3c869863597a5ada39b55ba9c738dbc169047

SHA256
4f5d17fed4aa3f439bb88c3261da341b6450adc2f61d9f0a0163aab062491ded

SHA512
db59758b2632dede0c02672fc998eadfa5d9dbd5ff1c291d0abdf6c1e08271c000156cd6ad6a9db832d52ebf9d09fbaa657ea9665709302479d5c42db9a38d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\cehalnfeamlkklmccceghmeegkdpbddo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\cehalnfeamlkklmccceghmeegkdpbddo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\cehalnfeamlkklmccceghmeegkdpbddo\manifest.json

Filesize
499B

MD5
c68ffa3667181c319f74a09b1f0bfe98

SHA1
4478a336b502c3655c88e82043c4adcefd413687

SHA256
99368abe356844c56017e28043fb7f64aacb650a526764420ff3b487ef63c5a6

SHA512
542df8c48934cc6d00fc3dc8e51e6a5c0d86e6db08ee466e94212a758c19198c7e7f05d1e2462e8b50b91f34458717594e8a4afa7e3d9eb2bd6127936256dad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\hhSHRnwYJJhp9XX.dat

Filesize
6KB

MD5
9e258b6e4296fc01e72cbe337400d5f1

SHA1
5e2236e71c5c0195da4f92b6c70860fb01ea3617

SHA256
7ebf7260148dc15b3a972565ff52b7e300cfe074f7a2f0dfa15a88bec213b42d

SHA512
34792ffea777954d7c20b9ba9cc013c4b797d28ab17cf3d45afd08dc73981b08d1681265f7f16be09c1d90c127b3d5445902cad70fb1dc314306b82b4388598b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\hhSHRnwYJJhp9XX.exe

Filesize
623KB

MD5
84732b41d5fc6660d9a30a43ad4398c2

SHA1
0afe25c3651aa0da868df654a39c0e34c909090a

SHA256
83d4d9d37a153b742deaf66cf7e628abb8ea592c8fb2b0ba5eaf669dcbe5c688

SHA512
6216a8a3428c7eadf49eee6204d1294a15fb4801b22dceb982f2feb3ced249a02ce9945001cab2b19012133228ac276bf02526953b75ecb3e3731c8bec4ff3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8D12.tmp\hhSHRnwYJJhp9XX.exe

Filesize
623KB

MD5
84732b41d5fc6660d9a30a43ad4398c2

SHA1
0afe25c3651aa0da868df654a39c0e34c909090a

SHA256
83d4d9d37a153b742deaf66cf7e628abb8ea592c8fb2b0ba5eaf669dcbe5c688

SHA512
6216a8a3428c7eadf49eee6204d1294a15fb4801b22dceb982f2feb3ced249a02ce9945001cab2b19012133228ac276bf02526953b75ecb3e3731c8bec4ff3b0

Download Submit