Analysis
-
max time kernel
27s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 22:23
Static task
static1
Behavioral task
behavioral1
Sample
f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe
Resource
win7-20221111-en
General
-
Target
f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe
-
Size
2.1MB
-
MD5
7ab838793d9d5a9fe35e26de653cd494
-
SHA1
34845c6c928ae77b1c4be97eb638a9da8e92bd26
-
SHA256
f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466
-
SHA512
f70326fc0ff9b1ca36fd64f588bcbbc5ffc7a7587f88d57617655d4ec860b4d614daf1c667234680787498e210181a5ad6a24394fb6521e5e7f68c6f2bca992c
-
SSDEEP
49152:h1Os9YIGWkf6jd9YMhKKumq+4oAczj/i6jgvb7GvKSn:h1Ocdd9YMhKgq+4fE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1736 FA8WbEBi0VF5T13.exe -
Loads dropped DLL 4 IoCs
pid Process 2028 f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe 1736 FA8WbEBi0VF5T13.exe 1504 regsvr32.exe 1692 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabnakoligdbmbbjnjjfjofaeioikblo\2.0\manifest.json FA8WbEBi0VF5T13.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabnakoligdbmbbjnjjfjofaeioikblo\2.0\manifest.json FA8WbEBi0VF5T13.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabnakoligdbmbbjnjjfjofaeioikblo\2.0\manifest.json FA8WbEBi0VF5T13.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} FA8WbEBi0VF5T13.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} FA8WbEBi0VF5T13.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} FA8WbEBi0VF5T13.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects FA8WbEBi0VF5T13.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ FA8WbEBi0VF5T13.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll FA8WbEBi0VF5T13.exe File opened for modification C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll FA8WbEBi0VF5T13.exe File created C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.dll FA8WbEBi0VF5T13.exe File opened for modification C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.dll FA8WbEBi0VF5T13.exe File created C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.tlb FA8WbEBi0VF5T13.exe File opened for modification C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.tlb FA8WbEBi0VF5T13.exe File created C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.dat FA8WbEBi0VF5T13.exe File opened for modification C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.dat FA8WbEBi0VF5T13.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1736 2028 f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe 28 PID 2028 wrote to memory of 1736 2028 f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe 28 PID 2028 wrote to memory of 1736 2028 f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe 28 PID 2028 wrote to memory of 1736 2028 f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe 28 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1736 wrote to memory of 1504 1736 FA8WbEBi0VF5T13.exe 29 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30 PID 1504 wrote to memory of 1692 1504 regsvr32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe"C:\Users\Admin\AppData\Local\Temp\f0ebb33624e87034ff65dc09482e90b90f81991f43bb06154ecfd9a6ad2de466.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\FA8WbEBi0VF5T13.exe.\FA8WbEBi0VF5T13.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSAAve\5loIL7fIEPLz9N.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:1692
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5111d161d03633788b5c1b266544d4bc1
SHA1c0da6ab3ef7dbe5ae019b625a0dd65e7916636d1
SHA25680021cbf6b6a569f32a0402ce29ed150863b524f32fdd5ad584a81af5a611f61
SHA512f308a3c09d16af78ba1cea310684577f5f4a481bee99c7f608630e41c89962d7e89086d6339a5e13437491303220a988a7921be747fe547c03e088eedf3b7d9b
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
623KB
MD5103866fff4628ada4be6e5235b2ebf5d
SHA186ca018b33c7cdb953371ee1e290313b9a54a251
SHA256963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c
SHA5122a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3
-
Filesize
3KB
MD53c920faafd032eeda08e4166860d4318
SHA126451ee3659c4a217f42ebd07f254679ab452f3a
SHA2563377d0af1044505271c64fc342e22a7a24b757e5471657f656ac743373e22857
SHA512327668001f94842eee3ff1dc44c70ddca5da3a0bb49aeea6b3162608b07496456e78bcb3de0462e5e375b349e813f13fd02e61b9e389b1d954cea2628c3c4a6e
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
6KB
MD5111d161d03633788b5c1b266544d4bc1
SHA1c0da6ab3ef7dbe5ae019b625a0dd65e7916636d1
SHA25680021cbf6b6a569f32a0402ce29ed150863b524f32fdd5ad584a81af5a611f61
SHA512f308a3c09d16af78ba1cea310684577f5f4a481bee99c7f608630e41c89962d7e89086d6339a5e13437491303220a988a7921be747fe547c03e088eedf3b7d9b
-
Filesize
629KB
MD5150107c0a55484355ce5881240cca669
SHA135d2f6723091fc4af5c4a00645b6b0f43efd4a06
SHA256c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e
SHA512eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04
-
Filesize
629KB
MD5150107c0a55484355ce5881240cca669
SHA135d2f6723091fc4af5c4a00645b6b0f43efd4a06
SHA256c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e
SHA512eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04
-
Filesize
5KB
MD5c9d624f9e9e0a37c254d76c20b4030d9
SHA10aa2a7fe89f540efdc9d5879d11110675be20d02
SHA2560da947fed82c0147766d68fcbf7e736dff2a93562f84c7c6ef0452478f1e71fc
SHA5128abb65ac90da2c89713f5c7da08764b40e117846af1881015d9f44e07135b81c3d656cbb56667149740714cfe59efd01afefff7c1144e3599443fc949e2b1e39
-
Filesize
143B
MD5eb72068a6e0fd43704d70f4be91e9c05
SHA1aaeed8aefefe53f51107d612006c19deec0832df
SHA25671d2cec1c8d572f38d28f72ff33e90f385f602ab15fe8b4c8152dcd7f21076ea
SHA5129e451dfb7a340f6df7a69426331e2c8e892996a293975d7332b60887dd247ff4ceec7a72d379f10cd4dea25d4691ada597207b0e261ff7f06f4659027c40287a
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
499B
MD56cd8a36a104ca5c570cf133e11b146b4
SHA1906f2b41c1f4186deda3e4d172c1c01cd7bc5e75
SHA256c9f32a4845bae80d8bdd8875943d5b6b2d7128f3ef1befe2a1417b42500edbef
SHA51257fc865bd097dcc18d8218c563e2ea8d969834ad1c6e2969141babf30c8cbb5d39e17100cf74062ce10a3d1172d14adbb4a051881bd1a49c13a23fe1e3f38e9a
-
C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\chrome.manifest
Filesize35B
MD51b463a188496c376821d564023c74bd6
SHA1156f410a7365a2f8d5c08069812869a4109a81be
SHA256ba35a7c14e0cdc8797ec84105901de81fb7155fa2a35820b0642f16965e9befd
SHA51272b6cba3bec9c77abbf2578e884cec50cc982a74a18d2d17579fcacd2c9949e8c2fb1e04c13148928342502d8f786bf21961daa7f63d546a91a89c30aea24773
-
C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\content\bg.js
Filesize7KB
MD516397b4cd92327bfe3c47fd98b0216da
SHA1298f7f8106f24da416b0e90e835dc46c2cec984f
SHA256a0be8b88e4d190845f3b5503192b32ecf917e3c1b3b78971767a5019b8b5e84a
SHA512c22f111b77f1186b2161d1d65a68d03c5e102d70616d60032491e5821fb8e8a9367bb800b03f30c70c901fe3596d5d03bf70d0da0e2820d061ca953bed7e0fd7
-
C:\Users\Admin\AppData\Local\Temp\7zSCDAC.tmp\[email protected]\install.rdf
Filesize592B
MD5e55cedd34d662bc0fbec1ad0fda86121
SHA197b5712eeeb8bd152669b361dabacc7fafdd26f4
SHA25647a2a7d959d372ad97eb304edf12adfeda018c0736d1d5855721d7fcadffe222
SHA51262bca4b15f3bc82bf757b0a3c411cb3eee132f57f796157466e7cc019d885db6f0394decb1608cd57438185a70a4e71c3bb48f23c5ce3ebfe299af13043dc188
-
Filesize
623KB
MD5103866fff4628ada4be6e5235b2ebf5d
SHA186ca018b33c7cdb953371ee1e290313b9a54a251
SHA256963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c
SHA5122a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
629KB
MD5150107c0a55484355ce5881240cca669
SHA135d2f6723091fc4af5c4a00645b6b0f43efd4a06
SHA256c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e
SHA512eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04