Analysis

  • max time kernel
    27s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 22:23

General

  • Target

    f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe

  • Size

    2.1MB

  • MD5

    7ab838793d9d5a9fe35e26de653cd494

  • SHA1

    34845c6c928ae77b1c4be97eb638a9da8e92bd26

  • SHA256

    f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466

  • SHA512

    f70326fc0ff9b1ca36fd64f588bcbbc5ffc7a7587f88d57617655d4ec860b4d614daf1c667234680787498e210181a5ad6a24394fb6521e5e7f68c6f2bca992c

  • SSDEEP

    49152:h1Os9YIGWkf6jd9YMhKKumq+4oAczj/i6jgvb7GvKSn:h1Ocdd9YMhKgq+4fE

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe
    "C:\Users\Admin\AppData\Local\Temp\f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\FA8WbEBi0VF5T13.exe
      .\FA8WbEBi0VF5T13.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.dat

    Filesize

    6KB

    MD5

    111d161d03633788b5c1b266544d4bc1

    SHA1

    c0da6ab3ef7dbe5ae019b625a0dd65e7916636d1

    SHA256

    80021cbf6b6a569f32a0402ce29ed150863b524f32fdd5ad584a81af5a611f61

    SHA512

    f308a3c09d16af78ba1cea310684577f5f4a481bee99c7f608630e41c89962d7e89086d6339a5e13437491303220a988a7921be747fe547c03e088eedf3b7d9b

  • C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll

    Filesize

    700KB

    MD5

    401087ab67c6d917bf08d82f011d9eee

    SHA1

    d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

    SHA256

    fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

    SHA512

    4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\5loIL7fIEPLz9N.dll

    Filesize

    623KB

    MD5

    103866fff4628ada4be6e5235b2ebf5d

    SHA1

    86ca018b33c7cdb953371ee1e290313b9a54a251

    SHA256

    963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c

    SHA512

    2a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\5loIL7fIEPLz9N.tlb

    Filesize

    3KB

    MD5

    3c920faafd032eeda08e4166860d4318

    SHA1

    26451ee3659c4a217f42ebd07f254679ab452f3a

    SHA256

    3377d0af1044505271c64fc342e22a7a24b757e5471657f656ac743373e22857

    SHA512

    327668001f94842eee3ff1dc44c70ddca5da3a0bb49aeea6b3162608b07496456e78bcb3de0462e5e375b349e813f13fd02e61b9e389b1d954cea2628c3c4a6e

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\5loIL7fIEPLz9N.x64.dll

    Filesize

    700KB

    MD5

    401087ab67c6d917bf08d82f011d9eee

    SHA1

    d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

    SHA256

    fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

    SHA512

    4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\FA8WbEBi0VF5T13.dat

    Filesize

    6KB

    MD5

    111d161d03633788b5c1b266544d4bc1

    SHA1

    c0da6ab3ef7dbe5ae019b625a0dd65e7916636d1

    SHA256

    80021cbf6b6a569f32a0402ce29ed150863b524f32fdd5ad584a81af5a611f61

    SHA512

    f308a3c09d16af78ba1cea310684577f5f4a481bee99c7f608630e41c89962d7e89086d6339a5e13437491303220a988a7921be747fe547c03e088eedf3b7d9b

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\FA8WbEBi0VF5T13.exe

    Filesize

    629KB

    MD5

    150107c0a55484355ce5881240cca669

    SHA1

    35d2f6723091fc4af5c4a00645b6b0f43efd4a06

    SHA256

    c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e

    SHA512

    eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\FA8WbEBi0VF5T13.exe

    Filesize

    629KB

    MD5

    150107c0a55484355ce5881240cca669

    SHA1

    35d2f6723091fc4af5c4a00645b6b0f43efd4a06

    SHA256

    c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e

    SHA512

    eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\kabnakoligdbmbbjnjjfjofaeioikblo\EAmXAE.js

    Filesize

    5KB

    MD5

    c9d624f9e9e0a37c254d76c20b4030d9

    SHA1

    0aa2a7fe89f540efdc9d5879d11110675be20d02

    SHA256

    0da947fed82c0147766d68fcbf7e736dff2a93562f84c7c6ef0452478f1e71fc

    SHA512

    8abb65ac90da2c89713f5c7da08764b40e117846af1881015d9f44e07135b81c3d656cbb56667149740714cfe59efd01afefff7c1144e3599443fc949e2b1e39

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\kabnakoligdbmbbjnjjfjofaeioikblo\background.html

    Filesize

    143B

    MD5

    eb72068a6e0fd43704d70f4be91e9c05

    SHA1

    aaeed8aefefe53f51107d612006c19deec0832df

    SHA256

    71d2cec1c8d572f38d28f72ff33e90f385f602ab15fe8b4c8152dcd7f21076ea

    SHA512

    9e451dfb7a340f6df7a69426331e2c8e892996a293975d7332b60887dd247ff4ceec7a72d379f10cd4dea25d4691ada597207b0e261ff7f06f4659027c40287a

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\kabnakoligdbmbbjnjjfjofaeioikblo\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\kabnakoligdbmbbjnjjfjofaeioikblo\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\kabnakoligdbmbbjnjjfjofaeioikblo\manifest.json

    Filesize

    499B

    MD5

    6cd8a36a104ca5c570cf133e11b146b4

    SHA1

    906f2b41c1f4186deda3e4d172c1c01cd7bc5e75

    SHA256

    c9f32a4845bae80d8bdd8875943d5b6b2d7128f3ef1befe2a1417b42500edbef

    SHA512

    57fc865bd097dcc18d8218c563e2ea8d969834ad1c6e2969141babf30c8cbb5d39e17100cf74062ce10a3d1172d14adbb4a051881bd1a49c13a23fe1e3f38e9a

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    1b463a188496c376821d564023c74bd6

    SHA1

    156f410a7365a2f8d5c08069812869a4109a81be

    SHA256

    ba35a7c14e0cdc8797ec84105901de81fb7155fa2a35820b0642f16965e9befd

    SHA512

    72b6cba3bec9c77abbf2578e884cec50cc982a74a18d2d17579fcacd2c9949e8c2fb1e04c13148928342502d8f786bf21961daa7f63d546a91a89c30aea24773

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    16397b4cd92327bfe3c47fd98b0216da

    SHA1

    298f7f8106f24da416b0e90e835dc46c2cec984f

    SHA256

    a0be8b88e4d190845f3b5503192b32ecf917e3c1b3b78971767a5019b8b5e84a

    SHA512

    c22f111b77f1186b2161d1d65a68d03c5e102d70616d60032491e5821fb8e8a9367bb800b03f30c70c901fe3596d5d03bf70d0da0e2820d061ca953bed7e0fd7

  • C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\install.rdf

    Filesize

    592B

    MD5

    e55cedd34d662bc0fbec1ad0fda86121

    SHA1

    97b5712eeeb8bd152669b361dabacc7fafdd26f4

    SHA256

    47a2a7d959d372ad97eb304edf12adfeda018c0736d1d5855721d7fcadffe222

    SHA512

    62bca4b15f3bc82bf757b0a3c411cb3eee132f57f796157466e7cc019d885db6f0394decb1608cd57438185a70a4e71c3bb48f23c5ce3ebfe299af13043dc188

  • \Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.dll

    Filesize

    623KB

    MD5

    103866fff4628ada4be6e5235b2ebf5d

    SHA1

    86ca018b33c7cdb953371ee1e290313b9a54a251

    SHA256

    963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c

    SHA512

    2a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3

  • \Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll

    Filesize

    700KB

    MD5

    401087ab67c6d917bf08d82f011d9eee

    SHA1

    d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

    SHA256

    fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

    SHA512

    4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

  • \Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll

    Filesize

    700KB

    MD5

    401087ab67c6d917bf08d82f011d9eee

    SHA1

    d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

    SHA256

    fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

    SHA512

    4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

  • \Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\FA8WbEBi0VF5T13.exe

    Filesize

    629KB

    MD5

    150107c0a55484355ce5881240cca669

    SHA1

    35d2f6723091fc4af5c4a00645b6b0f43efd4a06

    SHA256

    c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e

    SHA512

    eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04

  • memory/1504-73-0x0000000000000000-mapping.dmp

  • memory/1692-77-0x0000000000000000-mapping.dmp

  • memory/1692-78-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

    Filesize

    8KB

  • memory/1736-56-0x0000000000000000-mapping.dmp

  • memory/2028-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

    Filesize

    8KB