Analysis
-
max time kernel
9s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:45
Static task
static1
Behavioral task
behavioral1
Sample
edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe
Resource
win7-20221111-en
General
-
Target
edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe
-
Size
1.6MB
-
MD5
b171a17d36e359a00ab92b9ee293aee4
-
SHA1
06933c6254512894db8a4d6e4d7841ddd691b478
-
SHA256
edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a
-
SHA512
6f68bce6a371896253e676009b8ca65b85382d6e1d4f10229b41c5987b031e04d3e6cce1f77d756a0c559a9cd8e7f6827262c61e4518e2f76ec089bb30ddf25a
-
SSDEEP
24576:UKKxAR7eXyzZ3jnceKYqiGbEPdcXllSKR8YWzYEPQ+eeLqRQHHfA2AFEFHeB/5Qk:z7U8o0I1EPQ+eeLqRQHHfA2AFEFE/FV
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\leboaccpcmlbfldhcohnpfopblopjapd\2.0\manifest.json edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\leboaccpcmlbfldhcohnpfopblopjapd\2.0\manifest.json edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\leboaccpcmlbfldhcohnpfopblopjapd\2.0\manifest.json edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe -
Drops file in System32 directory 4 IoCs
Processes:
edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe File opened for modification C:\Windows\System32\GroupPolicy edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exepid process 936 edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe 936 edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe"C:\Users\Admin\AppData\Local\Temp\edf66299fe2c4e68e9efe45e7fe2968fa02ff7309a9b0509b0f7aaad0552a98a.exe"1⤵
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/936-54-0x0000000076941000-0x0000000076943000-memory.dmpFilesize
8KB
-
memory/936-55-0x0000000000BB0000-0x0000000000C57000-memory.dmpFilesize
668KB
-
memory/936-74-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-78-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-77-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-76-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-75-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-73-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-72-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-71-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-70-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-69-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-68-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-67-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-66-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-65-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-64-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-63-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-62-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-61-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB
-
memory/936-60-0x0000000000792000-0x0000000000796000-memory.dmpFilesize
16KB