71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8

Analysis

max time kernel
161s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8.exe
Size

2.1MB
MD5

39d6158b9634a824cdc474521212c4b6
SHA1

215f1bd83b57499c2ee27e276093429339721aaf
SHA256

71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8
SHA512

779871bb890eeae5ce2cf66b9ca31ca82169cfc6b186079e4d49c6c1b262f15cd304a0624070ca9697d5fd272519c78f3ce5ccd617039ea8e2161dd9c3ba16c2
SSDEEP

49152:h1OsEYIGWkf6jd9YMhKKumq+4oAczj/i6jgvb7GvKSS:h1Obdd9YMhKgq+4fR

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4772	nmIVBaAcq8ZHOm6.exe

Loads dropped DLL 3 IoCs

pid	Process
4772	nmIVBaAcq8ZHOm6.exe
3460	regsvr32.exe
1528	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipjemigjmbjfphpbipldbbmkanoocfpl\2.0\manifest.json	nmIVBaAcq8ZHOm6.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipjemigjmbjfphpbipldbbmkanoocfpl\2.0\manifest.json	nmIVBaAcq8ZHOm6.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipjemigjmbjfphpbipldbbmkanoocfpl\2.0\manifest.json	nmIVBaAcq8ZHOm6.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipjemigjmbjfphpbipldbbmkanoocfpl\2.0\manifest.json	nmIVBaAcq8ZHOm6.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipjemigjmbjfphpbipldbbmkanoocfpl\2.0\manifest.json	nmIVBaAcq8ZHOm6.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	nmIVBaAcq8ZHOm6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	nmIVBaAcq8ZHOm6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	nmIVBaAcq8ZHOm6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	nmIVBaAcq8ZHOm6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.tlb	nmIVBaAcq8ZHOm6.exe
File created	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.dat	nmIVBaAcq8ZHOm6.exe
File opened for modification	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.dat	nmIVBaAcq8ZHOm6.exe
File created	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll	nmIVBaAcq8ZHOm6.exe
File opened for modification	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll	nmIVBaAcq8ZHOm6.exe
File created	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.dll	nmIVBaAcq8ZHOm6.exe
File opened for modification	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.dll	nmIVBaAcq8ZHOm6.exe
File created	C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.tlb	nmIVBaAcq8ZHOm6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4772	4088	71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8.exe	79
PID 4088 wrote to memory of 4772	4088	71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8.exe	79
PID 4088 wrote to memory of 4772	4088	71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8.exe	79
PID 4772 wrote to memory of 3460	4772	nmIVBaAcq8ZHOm6.exe	80
PID 4772 wrote to memory of 3460	4772	nmIVBaAcq8ZHOm6.exe	80
PID 4772 wrote to memory of 3460	4772	nmIVBaAcq8ZHOm6.exe	80
PID 3460 wrote to memory of 1528	3460	regsvr32.exe	81
PID 3460 wrote to memory of 1528	3460	regsvr32.exe	81

C:\Users\Admin\AppData\Local\Temp\71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8.exe
"C:\Users\Admin\AppData\Local\Temp\71742913d25341a927544accc71ffc3428a877e8a220b2b6dc5ffc1f9b734ae8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\nmIVBaAcq8ZHOm6.exe
  .\nmIVBaAcq8ZHOm6.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.dat

Filesize
6KB

MD5
d568334d2b9b512f3721ef1ef20233e1

SHA1
d17f9386fa077d74aa5c8f0de6b0db9273dca86b

SHA256
80aaa618037a7d743862ff6d718ac9761c15df4dc38a841a2feb2a552409b175

SHA512
8079d26ed31178a3020be485597f0c21357a2ef3091a83dd22d10bb52385c912ec2aca17cc6e63c441eadeb1c3fee922b825902ce88b720a1433a1c12c892e5a

Download Submit
C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.dll

Filesize
623KB

MD5
103866fff4628ada4be6e5235b2ebf5d

SHA1
86ca018b33c7cdb953371ee1e290313b9a54a251

SHA256
963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c

SHA512
2a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3

Download Submit
C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll

Filesize
700KB

MD5
401087ab67c6d917bf08d82f011d9eee

SHA1
d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

SHA256
fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

SHA512
4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

Download Submit
C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll

Filesize
700KB

MD5
401087ab67c6d917bf08d82f011d9eee

SHA1
d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

SHA256
fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

SHA512
4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

Download Submit
C:\Program Files (x86)\GoSaive\tAlrN3kOUF0hEX.x64.dll

Filesize
700KB

MD5
401087ab67c6d917bf08d82f011d9eee

SHA1
d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

SHA256
fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

SHA512
4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
49bddc993f7763636be59385dacf73bd

SHA1
65918021a5cc0acfcb9c3c43aab7b67f8269ee61

SHA256
b743c2e1bf9f5e80e0167cca63bb18b9129bc622e40981c831ddd5044ccacd30

SHA512
d3452403d234f50f2cba777b3c71551697a20aec04357dbc40ee483870fcca3c5bb1d309332c02e409a9262934b055c469184893c91ca1d4ab6b9170190a3278

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
a06430665a8d9bbe85df0dfc6cec1071

SHA1
992749c8095b60e8a9fb57f4103ab85bbf405f95

SHA256
c781003d4f17a69c1373d00510220335de1b1b624be96c4bc16e3b9804cab461

SHA512
48554e3a46c4035771f3c415ef16cf60461efe865a4a6223d615b12dd1e3e7d5ca768ce23768a86ea29621a24d9d6074d4847576301bd4c2b7d7677560fe4009

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\[email protected]\install.rdf

Filesize
596B

MD5
cc761ad2ed7ed33967261f9ec60d7398

SHA1
60db7f3e08e5f9cf661f71d35fef676b92422cb4

SHA256
20f0c0d39f1ac220899d33d6d0941f8e186a316af8d56c06336e69d48053d453

SHA512
db05942a385fa530142fcbe4bef431d62dbf267f87452105a93b682b6ae1f966e92e568092179cabc6d55d66468c220a506613b208a8f8c1edfd9fde6f185bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\ipjemigjmbjfphpbipldbbmkanoocfpl\background.html

Filesize
145B

MD5
bc416dd5949aeec0d33458a730fbebb2

SHA1
0c5a8bc805e625a6e4ed837999afd98363e20608

SHA256
84baea805a55ac76c5eda41e291d9e3174a24832b74b44b063407e169727f4a1

SHA512
5833fb9e40975367062e1f15f216ee33e5f957b58ddc94871e4f154da401ddcec86264c216aca697f324cd8b8b9967d43d1d74cfa19c99951d5f24ebed1637d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\ipjemigjmbjfphpbipldbbmkanoocfpl\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\ipjemigjmbjfphpbipldbbmkanoocfpl\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\ipjemigjmbjfphpbipldbbmkanoocfpl\manifest.json

Filesize
499B

MD5
9ab7fff9f9835e96d693f50be6c718c1

SHA1
aa62433aa843dbedb095e4b32a0ad99e656119c5

SHA256
f283a02469301a791edbf56cb8a669889106a5561ef463901ccca63c8bc19044

SHA512
f1550485f9414a10c4062910e87425b89eb65c95c7245432b8f09b1d437324fb506dcef316c34d930945ec6b6699381fadd967fec7ffcec1b77cfa0d206a8b72

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\ipjemigjmbjfphpbipldbbmkanoocfpl\sQUgU5iR.js

Filesize
5KB

MD5
4f015c332e59ebe301fa693b71f178ee

SHA1
23a75a018c6153aaa11c5dbf1ae55fc559467116

SHA256
43593d7ef10ef7abdeae7a02ede6a3be407cc605252e6efb95e343f77d5afbb6

SHA512
d470fae323d277dbdd0531e03b362f4ff3a3c853a7c8b52ba7171e43c1e19ed6e06d036edb23b2672f41e86ca513fd0937c1debd20045461e05b9187b546acef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\nmIVBaAcq8ZHOm6.dat

Filesize
6KB

MD5
d568334d2b9b512f3721ef1ef20233e1

SHA1
d17f9386fa077d74aa5c8f0de6b0db9273dca86b

SHA256
80aaa618037a7d743862ff6d718ac9761c15df4dc38a841a2feb2a552409b175

SHA512
8079d26ed31178a3020be485597f0c21357a2ef3091a83dd22d10bb52385c912ec2aca17cc6e63c441eadeb1c3fee922b825902ce88b720a1433a1c12c892e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\nmIVBaAcq8ZHOm6.exe

Filesize
629KB

MD5
150107c0a55484355ce5881240cca669

SHA1
35d2f6723091fc4af5c4a00645b6b0f43efd4a06

SHA256
c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e

SHA512
eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\nmIVBaAcq8ZHOm6.exe

Filesize
629KB

MD5
150107c0a55484355ce5881240cca669

SHA1
35d2f6723091fc4af5c4a00645b6b0f43efd4a06

SHA256
c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e

SHA512
eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\tAlrN3kOUF0hEX.dll

Filesize
623KB

MD5
103866fff4628ada4be6e5235b2ebf5d

SHA1
86ca018b33c7cdb953371ee1e290313b9a54a251

SHA256
963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c

SHA512
2a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\tAlrN3kOUF0hEX.tlb

Filesize
3KB

MD5
3c920faafd032eeda08e4166860d4318

SHA1
26451ee3659c4a217f42ebd07f254679ab452f3a

SHA256
3377d0af1044505271c64fc342e22a7a24b757e5471657f656ac743373e22857

SHA512
327668001f94842eee3ff1dc44c70ddca5da3a0bb49aeea6b3162608b07496456e78bcb3de0462e5e375b349e813f13fd02e61b9e389b1d954cea2628c3c4a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB858.tmp\tAlrN3kOUF0hEX.x64.dll

Filesize
700KB

MD5
401087ab67c6d917bf08d82f011d9eee

SHA1
d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

SHA256
fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

SHA512
4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

Download Submit