1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e.exe
Size

2.1MB
MD5

c30ea9700d7f3c43aea4439243ff7cd7
SHA1

f038b7e154ab113f614827f1c61a3e6e86c037b9
SHA256

1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e
SHA512

2fd03b15e747eb0a54732c39f1bf3f1d037e4a2791190222c56773d9551d4156b1a518cecc9ab076e5b05511f8ffee749b482d6ea80779f05ec046912453d9ff
SSDEEP

24576:h1OYdaOxidvpcWU0nkjpTu1aiwB+JtP2ItjRwcOHx0pFz8rrqbk8250uj5rc6bJe:h1Os65/nkFTZaPPRwTR0ptyI2q8jbJGv

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2268	gQdN8bNczgHgn7e.exe

Loads dropped DLL 3 IoCs

pid	Process
2268	gQdN8bNczgHgn7e.exe
4888	regsvr32.exe
4904	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\2.0\manifest.json	gQdN8bNczgHgn7e.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\2.0\manifest.json	gQdN8bNczgHgn7e.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\2.0\manifest.json	gQdN8bNczgHgn7e.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\2.0\manifest.json	gQdN8bNczgHgn7e.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\2.0\manifest.json	gQdN8bNczgHgn7e.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	gQdN8bNczgHgn7e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	gQdN8bNczgHgn7e.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	gQdN8bNczgHgn7e.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	gQdN8bNczgHgn7e.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.dat	gQdN8bNczgHgn7e.exe
File created	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll	gQdN8bNczgHgn7e.exe
File opened for modification	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll	gQdN8bNczgHgn7e.exe
File created	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.dll	gQdN8bNczgHgn7e.exe
File opened for modification	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.dll	gQdN8bNczgHgn7e.exe
File created	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.tlb	gQdN8bNczgHgn7e.exe
File opened for modification	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.tlb	gQdN8bNczgHgn7e.exe
File created	C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.dat	gQdN8bNczgHgn7e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2268	2560	1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e.exe	80
PID 2560 wrote to memory of 2268	2560	1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e.exe	80
PID 2560 wrote to memory of 2268	2560	1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e.exe	80
PID 2268 wrote to memory of 4888	2268	gQdN8bNczgHgn7e.exe	81
PID 2268 wrote to memory of 4888	2268	gQdN8bNczgHgn7e.exe	81
PID 2268 wrote to memory of 4888	2268	gQdN8bNczgHgn7e.exe	81
PID 4888 wrote to memory of 4904	4888	regsvr32.exe	82
PID 4888 wrote to memory of 4904	4888	regsvr32.exe	82

C:\Users\Admin\AppData\Local\Temp\1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e.exe
"C:\Users\Admin\AppData\Local\Temp\1b336f2143b016fdfd1638571239e90344a9ce2f50220e6b13ae50bc37d23c3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\gQdN8bNczgHgn7e.exe
  .\gQdN8bNczgHgn7e.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.dat

Filesize
6KB

MD5
83123e8fb575dbb3e721e5608455e29d

SHA1
858ad3e23f29e7a01a417995db15de512e0dd1d4

SHA256
376106f3a414ba3f81321361441b2ad7e091e717c39dcf6abb6f2b6f58627754

SHA512
217b2991929a616eb1a292232d3bbd479cfd8f8fd63d793b65a4c44c112bcb585e18833d2a927f6036200d43bfc24cecf96ad0b507635329ad6b2475d0356422

Download Submit
C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.dll

Filesize
608KB

MD5
0a8d35bd724d803984bb64ae91deb8b5

SHA1
1d2a0e9db9278fde2d2aab979036671f2985c4be

SHA256
a44498519e643c24d57943cdf34d8ced80fce043a370c29def1a0f7388dde3a2

SHA512
9c3a21f75c5598976ef5896eca7e21a7f8d86f5948756e07f16f3528384c7dbe54cdaedd6d07bfdafb165d9a570d12db1ec3b20e74ca0d9cb944e1cfa85e5934

Download Submit
C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
C:\Program Files (x86)\GoSaave\fl9UVHGkYucf3r.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
2044fd1eefd1daf2692758cda9a0c1d4

SHA1
4cba0d3732c0d309c4e580629052a279d07bebaf

SHA256
5123ea1c402cddf3ef58efcbaf3889664b71eec23d9601a1ea4be5628c1ac648

SHA512
fe42ea6f3b7d0b046e89db9fb69af07005109dd6eccdf0be99ee093ecd7871ddf9cbcd7864d2c873cf42840b2b13e67ac1338366c551df411a31458acfadb107

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
e051deae2f0668bb13b62193d91e0112

SHA1
27abcb5175414c9e022fef9cf224de5a05bb40a4

SHA256
e43d2f86e9d766512b9cc877e956994ade3638d501911c8d462bc90ae792a2b8

SHA512
b570bfff9ac4c88c2421b2b7dc99d2719cfbd99aa88689173a98f643baa29800e7b822f1c4fa7657fbdcef89ec55cbf960d9b6dcadfd01e98bbb3e43a0f3e2ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\[email protected]\install.rdf

Filesize
596B

MD5
11500ba3e00023c4839b28cb4c0c16e1

SHA1
668c50cb9a2e43d9b3d80c2795d2e2b6e8af1352

SHA256
bfbd14fddde1beaebd844cf1da895648699f8645b191f2d2ee9fc362253aa2da

SHA512
f6b71d889fa09e9f8ed92f4a399a18823c7b35dc939c57ad1953a828e1c7480a69d3dd160006b26f78c98758078abb405e6c0536edcfc3e6b8d48df6b0966412

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\ED19dAdrm.js

Filesize
5KB

MD5
0f65f8cab82a396861e8ff418ba50819

SHA1
4590257a7c807b85818f5f17ee29738932a45337

SHA256
0bcc6b4849b637586f4ac9120d9b17f7d5e94054e2e1146cbbbea5f593b1a9c6

SHA512
f7ab7a223c58e664e11cc30af81f05fef38ded6f371737b7aa14d687ba7115dedbe9f2bf3748a3e369926cf81c0e7eb8d81d5022b276085b4820b8d513be90bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\background.html

Filesize
146B

MD5
20378add89a14bd7161dbc5e2e7640f1

SHA1
ba638b1e9dc64abed26bf0b23a8217079b1c31f9

SHA256
3d013a2d724831e43a416d38823be5c8213368aa9d5c0f412f7b78e85831b945

SHA512
6e5d76eb6e01338cee5bcc9feeb7d932caee0ebc586c1a305e89022e4b776943ea5a25fd20c94c8945872c4d0554cbbc3cee63bd05f99515275308da32d19136

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fkijhjhkgfhcjhpmmbchjhinpapkgbhl\manifest.json

Filesize
499B

MD5
8c7c8cb66c68d94aa916e3016f897ecb

SHA1
e6ea4adf43e4ec062d803b356d126e39d8841bda

SHA256
e79509976db316973ce4b643fa3a0212a415c170a48637c3a58bc1311211c3ab

SHA512
3903674cd23be16348c10aac4f0846f8bfcefa0f8cbc29da47b74981e1151f9003d9bc39e98d320d2340412559507533ffc96dd06817d6df2e088c51868ff410

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fl9UVHGkYucf3r.dll

Filesize
608KB

MD5
0a8d35bd724d803984bb64ae91deb8b5

SHA1
1d2a0e9db9278fde2d2aab979036671f2985c4be

SHA256
a44498519e643c24d57943cdf34d8ced80fce043a370c29def1a0f7388dde3a2

SHA512
9c3a21f75c5598976ef5896eca7e21a7f8d86f5948756e07f16f3528384c7dbe54cdaedd6d07bfdafb165d9a570d12db1ec3b20e74ca0d9cb944e1cfa85e5934

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fl9UVHGkYucf3r.tlb

Filesize
3KB

MD5
825074f7df4e6542c682e2529c7c2bc8

SHA1
0c11e0abe3bd3bfd0edaa4a9e79c65cf165ca7ed

SHA256
cf76185e63bf7b048aaccabe85522f4bbf987cd159e93dc7e8ee3f13312e101e

SHA512
d249ba8d1f5940dcdd745f13e9ead69469cf8c547561a06bcc443c20b1a62fce799e59dc59fc5d07d312836bbeed1c85a9abc943210d328c7605b502a520d44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\fl9UVHGkYucf3r.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\gQdN8bNczgHgn7e.dat

Filesize
6KB

MD5
83123e8fb575dbb3e721e5608455e29d

SHA1
858ad3e23f29e7a01a417995db15de512e0dd1d4

SHA256
376106f3a414ba3f81321361441b2ad7e091e717c39dcf6abb6f2b6f58627754

SHA512
217b2991929a616eb1a292232d3bbd479cfd8f8fd63d793b65a4c44c112bcb585e18833d2a927f6036200d43bfc24cecf96ad0b507635329ad6b2475d0356422

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\gQdN8bNczgHgn7e.exe

Filesize
643KB

MD5
239a80538887713f0d8471057f55e170

SHA1
4df6ef79bd07d962cc09c1279248af034fd22d03

SHA256
0ced38390b12b12a9aaec52a2ad8664e603c825abb318e5b743aed8a09afab78

SHA512
7b8c6f8270e2d7a2501e9eb11af4905d299c5e5dc3bd3b5bf8073cb22fd5677401ed2dd748d6ae0560be988bce257ca92ec19aa7b78740aa5ec53d98cf4936aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS792C.tmp\gQdN8bNczgHgn7e.exe

Filesize
643KB

MD5
239a80538887713f0d8471057f55e170

SHA1
4df6ef79bd07d962cc09c1279248af034fd22d03

SHA256
0ced38390b12b12a9aaec52a2ad8664e603c825abb318e5b743aed8a09afab78

SHA512
7b8c6f8270e2d7a2501e9eb11af4905d299c5e5dc3bd3b5bf8073cb22fd5677401ed2dd748d6ae0560be988bce257ca92ec19aa7b78740aa5ec53d98cf4936aa

Download Submit