Analysis
-
max time kernel
40s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 23:46
Static task
static1
Behavioral task
behavioral1
Sample
0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe
Resource
win10v2004-20221111-en
General
-
Target
0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe
-
Size
2.1MB
-
MD5
21c3ee0f2c56793156cb38d3a6f9f25a
-
SHA1
e45fa461d65cc3809c5a3abbc2fb572b2fef5c97
-
SHA256
0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e
-
SHA512
fa375f6c3d3778ef91565543f27f95a8eb7d6797716487d05e1f5c03337c3cd191af257c220c84b468a4bbc1be55f3412bc202e3373e4c59d41d0603e6e24063
-
SSDEEP
49152:h1OsIhvaZG1MVEtzijkTvu2x/uw4B8FHFF6Q:h1OhvaxMziy3h
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
aM7bkJ7UR9anvZt.exepid process 952 aM7bkJ7UR9anvZt.exe -
Loads dropped DLL 4 IoCs
Processes:
0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exeaM7bkJ7UR9anvZt.exeregsvr32.exeregsvr32.exepid process 968 0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe 952 aM7bkJ7UR9anvZt.exe 1468 regsvr32.exe 1512 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
aM7bkJ7UR9anvZt.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjoggochloabjoijcdpmgabiplojanje\2.0\manifest.json aM7bkJ7UR9anvZt.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjoggochloabjoijcdpmgabiplojanje\2.0\manifest.json aM7bkJ7UR9anvZt.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjoggochloabjoijcdpmgabiplojanje\2.0\manifest.json aM7bkJ7UR9anvZt.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
aM7bkJ7UR9anvZt.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} aM7bkJ7UR9anvZt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} aM7bkJ7UR9anvZt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} aM7bkJ7UR9anvZt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ aM7bkJ7UR9anvZt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects aM7bkJ7UR9anvZt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
aM7bkJ7UR9anvZt.exedescription ioc process File opened for modification C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.tlb aM7bkJ7UR9anvZt.exe File created C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.dat aM7bkJ7UR9anvZt.exe File opened for modification C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.dat aM7bkJ7UR9anvZt.exe File created C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dll aM7bkJ7UR9anvZt.exe File opened for modification C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dll aM7bkJ7UR9anvZt.exe File created C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.dll aM7bkJ7UR9anvZt.exe File opened for modification C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.dll aM7bkJ7UR9anvZt.exe File created C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.tlb aM7bkJ7UR9anvZt.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exeaM7bkJ7UR9anvZt.exeregsvr32.exedescription pid process target process PID 968 wrote to memory of 952 968 0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe aM7bkJ7UR9anvZt.exe PID 968 wrote to memory of 952 968 0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe aM7bkJ7UR9anvZt.exe PID 968 wrote to memory of 952 968 0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe aM7bkJ7UR9anvZt.exe PID 968 wrote to memory of 952 968 0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe aM7bkJ7UR9anvZt.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 952 wrote to memory of 1468 952 aM7bkJ7UR9anvZt.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe PID 1468 wrote to memory of 1512 1468 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe"C:\Users\Admin\AppData\Local\Temp\0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\aM7bkJ7UR9anvZt.exe.\aM7bkJ7UR9anvZt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.datFilesize
6KB
MD519b64458d852fb3879b290b8727c2848
SHA1e0e41bad90afe7bc0819ec3e4d90fef655e59a08
SHA256dfdc1c2bad885f55c2e0ab941fbcc0ced97373866d95b05905b22091f7183a66
SHA512637f1e78d89cbf74d66810ab0f3153dc0ec7420b331059090d18d8a035842d772a173606fcdfeeb46f3b6456231ccddfbc2e13ae26ec7e9a5984864ddf4dcf1b
-
C:\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dllFilesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\F6mXgQ4DOBqkLK.dllFilesize
618KB
MD5f180a95d8673cd01ce4af0ff678fa099
SHA18592fe958436e14ef9ace437ac4445ecca22e35e
SHA256d40aa49822621713e0f79f6c9a187468251fc22559cb1bbd6b5f71a94819eeb7
SHA5123dda5f3133df4c00c03d8b3fb539b37e2e6b26d0384d3674cefa9595136f9eaa4b9d21c0e806a9ec3cfadfb782a30e344145abbf87bca813de056f84c6fb13c9
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\F6mXgQ4DOBqkLK.tlbFilesize
3KB
MD58af6f42a5b16ced04702514d47052053
SHA1f06e43c9710e27b38063652217874f6fc8515ea0
SHA2560fc752f18e2f21a6d0b45fb9769deefe70d4690e72225037a37d1dc0553ae8ed
SHA5122d1fedf6693f0347d9265436fbc17515fa9a904db54170181ca7a6d5c64a4928494a20a1eb489d646602ed2769e570bfb5835bffd241a53a8fe64d5767b9234b
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\F6mXgQ4DOBqkLK.x64.dllFilesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\[email protected]\chrome.manifestFilesize
35B
MD54b6207be141b2032b4e9c9d163aebe4a
SHA18dd932b607c62584b5177afdffa905533733098a
SHA25674f8e09c89ddbbccee77dd9750210ac4da7d89b0374858ffb1c0e2dc231a3a98
SHA512f9a39471728a580a2154b7a5d4b50a0de11d75096cc6abbf9d9004d77ad0b4b98df87d0141fd38139a7230e876cfe8f297542e812b9a2c288edbe970025559c5
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\[email protected]\content\bg.jsFilesize
7KB
MD507388a9571e429c1f575354a50464069
SHA11f638359342304be391b40093ba00a506370aea7
SHA2564af130c42f25f6e58f873807786eb06070009732a21f3899edcbff6a21fc0593
SHA5128a36171b9293ff6d429f594bcb49b376a4259dffb1f492275b1b36e5f9879a1b2c067ecad2eb7ee7a1278d43c10830c95eb675c430249c5d3f07ca299a603492
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\[email protected]\install.rdfFilesize
593B
MD567b8bb259c5aed60ad7c089d0903d831
SHA1b73e0ad2079ec859b812c893792e554f644d64fc
SHA2567fb70d674dd0af22347b918f507c557623a564c25e1e829f4fa48be652f6077a
SHA512c725c2dfe1c18648d00cc5896e6d2ceebdecbcfa8adeb5df29573a51da8e85531a5be3c234cd428f3f6288f18f13d3b82afc4f1def5a247a4542300cc15129ad
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\aM7bkJ7UR9anvZt.datFilesize
6KB
MD519b64458d852fb3879b290b8727c2848
SHA1e0e41bad90afe7bc0819ec3e4d90fef655e59a08
SHA256dfdc1c2bad885f55c2e0ab941fbcc0ced97373866d95b05905b22091f7183a66
SHA512637f1e78d89cbf74d66810ab0f3153dc0ec7420b331059090d18d8a035842d772a173606fcdfeeb46f3b6456231ccddfbc2e13ae26ec7e9a5984864ddf4dcf1b
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\aM7bkJ7UR9anvZt.exeFilesize
634KB
MD5bd1503d4eaae5e7f2a8cdbd9a88ec02a
SHA1730280a7839bb46bdeeaa47797d926f8d57e1da1
SHA256724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4
SHA5120dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\aM7bkJ7UR9anvZt.exeFilesize
634KB
MD5bd1503d4eaae5e7f2a8cdbd9a88ec02a
SHA1730280a7839bb46bdeeaa47797d926f8d57e1da1
SHA256724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4
SHA5120dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\jjoggochloabjoijcdpmgabiplojanje\QDRBM8WG.jsFilesize
5KB
MD520b51530d61ece6d7db027f43f8f9547
SHA1595c161bc367f625314592e61e5c6399ddbcd1b6
SHA256800d7947ac93f82bf5a78f135c37780b0123ea01adfb2b3d87f060b6e0426e09
SHA512e987e51d8c8a50b4657ab84bace561330fb625c114ae6523d08123de19f8e5bc8ed50989e9eb083d5b2c7710f7342007a2a5510fb5097772cc61c25d93812726
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\jjoggochloabjoijcdpmgabiplojanje\background.htmlFilesize
145B
MD5c3989b0747253ff54ec53b6fc380c673
SHA1652ba9462f99d62f17c278a090155fc19dc020f7
SHA256b0c0d33a9ca753135157437e422f780f48c8508aeb72ba4cb2339d9f58f26eb6
SHA512de9ebc27419e0a86a987b6bcf435ee741bda246170ff53adec2049e04049068f02e1c44092db278804f7fcbf70e44bdb304a5c1aca95af74c7341bc7bb018a56
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\jjoggochloabjoijcdpmgabiplojanje\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\jjoggochloabjoijcdpmgabiplojanje\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\jjoggochloabjoijcdpmgabiplojanje\manifest.jsonFilesize
498B
MD55d8b560f900f00e62aa129f1fd677989
SHA150d03404e935374cada2779f89c33c096ce6fb80
SHA2569427cc79b9bd56a0ce543ab1cbb63264be500e5596b91a387afa5b7bebabcca2
SHA5123ed280bd8c5b377df319c09069efc8f17a873bc0cba878a835b1f61eb684594741538735ff6e43feb938778859aa19b4f9ce5cbaccdca0db1b4b54d6400cb7bc
-
\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.dllFilesize
618KB
MD5f180a95d8673cd01ce4af0ff678fa099
SHA18592fe958436e14ef9ace437ac4445ecca22e35e
SHA256d40aa49822621713e0f79f6c9a187468251fc22559cb1bbd6b5f71a94819eeb7
SHA5123dda5f3133df4c00c03d8b3fb539b37e2e6b26d0384d3674cefa9595136f9eaa4b9d21c0e806a9ec3cfadfb782a30e344145abbf87bca813de056f84c6fb13c9
-
\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dllFilesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
\Program Files (x86)\GoSAve\F6mXgQ4DOBqkLK.x64.dllFilesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
\Users\Admin\AppData\Local\Temp\7zSA90C.tmp\aM7bkJ7UR9anvZt.exeFilesize
634KB
MD5bd1503d4eaae5e7f2a8cdbd9a88ec02a
SHA1730280a7839bb46bdeeaa47797d926f8d57e1da1
SHA256724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4
SHA5120dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b
-
memory/952-56-0x0000000000000000-mapping.dmp
-
memory/968-54-0x0000000076221000-0x0000000076223000-memory.dmpFilesize
8KB
-
memory/1468-73-0x0000000000000000-mapping.dmp
-
memory/1512-77-0x0000000000000000-mapping.dmp
-
memory/1512-78-0x000007FEFC261000-0x000007FEFC263000-memory.dmpFilesize
8KB