95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe
Size

795KB
MD5

ac455902842b0446e5dc93ed2693dcde
SHA1

bd6b3972954dd9cbc90d67580e8a360415b73e6a
SHA256

95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f
SHA512

52220d58076e26c1d0b19713a7f99b71c402df9282bf7ef313afbceb8b16f24f94570405758d5b768bd39223ebb7d296a913ef155b696f0e3c8792e130b38d79
SSDEEP

24576:nNSkRXSgySpuCcN263qC0+W+NziCb8FTzNJ:okRi9mu/N266C0H53Tz

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

lMpKMq4L.exe

pid process

840 lMpKMq4L.exe
Loads dropped DLL 1 IoCs

Processes:

95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe

pid process

1364 95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
840	lMpKMq4L.exe

pid	process
1364	95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe

Drops Chrome extension 3 IoCs

Processes:

lMpKMq4L.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmpkifmmhofpahehjkehepglcfdfedf\2.1\manifest.json	lMpKMq4L.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmpkifmmhofpahehjkehepglcfdfedf\2.1\manifest.json	lMpKMq4L.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmpkifmmhofpahehjkehepglcfdfedf\2.1\manifest.json	lMpKMq4L.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

lMpKMq4L.exe

pid process

840 lMpKMq4L.exe
840 lMpKMq4L.exe
840 lMpKMq4L.exe
840 lMpKMq4L.exe
840 lMpKMq4L.exe
840 lMpKMq4L.exe

pid	process
840	lMpKMq4L.exe
840	lMpKMq4L.exe
840	lMpKMq4L.exe
840	lMpKMq4L.exe
840	lMpKMq4L.exe
840	lMpKMq4L.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

lMpKMq4L.exe

description	pid	process
Token: SeDebugPrivilege	840	lMpKMq4L.exe
Token: SeDebugPrivilege	840	lMpKMq4L.exe
Token: SeDebugPrivilege	840	lMpKMq4L.exe
Token: SeDebugPrivilege	840	lMpKMq4L.exe
Token: SeDebugPrivilege	840	lMpKMq4L.exe
Token: SeDebugPrivilege	840	lMpKMq4L.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe

description	pid	process	target process
PID 1364 wrote to memory of 840	1364	95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe	lMpKMq4L.exe
PID 1364 wrote to memory of 840	1364	95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe	lMpKMq4L.exe
PID 1364 wrote to memory of 840	1364	95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe	lMpKMq4L.exe
PID 1364 wrote to memory of 840	1364	95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe	lMpKMq4L.exe

C:\Users\Admin\AppData\Local\Temp\95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe
"C:\Users\Admin\AppData\Local\Temp\95434c716c955c75927fccb71f43c5e616cccb28107d5cda274f5f95ea029a4f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\lMpKMq4L.exe
"C:\Users\Admin\AppData\Local\Temp/5b3b6a4a/lMpKMq4L.exe"
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\[email protected]\chrome.manifest
Filesize
28B

MD5
4dd677b942bdcb0e1cacc5cc792d9269

SHA1
4ee86360b07008b46b9bd83b930562bfb6ababd2

SHA256
a6feb7ef0433607e1dbd66b633dfe8de9f24d9a9417e118afef0a6b81e30e604

SHA512
f2d67135ab19c3c500727f6ccc9d98e4d2f21c55ca18b17126416582e86c6a82f3b29f936d175fdf9f9570b66dde069c2cc7f8ee3356caded8d37bb2443919c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\[email protected]\content\bg.js
Filesize
8KB

MD5
d16bc672d9c0b477d1e0a1b231e89a71

SHA1
8b9fd6f80d35038f91cca46d2e9aad6dac181b8a

SHA256
9230eec00763ad4de41874794ad787a92a63731832ed08499e60b97325472c3f

SHA512
90cb01abc828f20b9745d9a9449df98ffad71def1c234ee38ffcf07e9fd947349eef38c6176af26f1252e60b460b995822dc692d6533ade67ee0d7e7d83ad8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\[email protected]\install.rdf
Filesize
598B

MD5
f7b49d60fce90dc0bed6dc8ae64abff3

SHA1
af04da676997ab831147e166b474557597bb03a2

SHA256
5e05e86f7ebbdbb0ee0ade783ced3f79108bfa013da6364dc9f7b51872915396

SHA512
e66dc90679d6fad6f150938260ae2af6a5d54dadc34cac5c7f9f77afadf9f531130f6e8180ae4f75e217f1fbadd5992c33b8ebc336134790a9933d9bdc0147da

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\icmpkifmmhofpahehjkehepglcfdfedf\Wg.js
Filesize
5KB

MD5
4e58cacfc912ba4882e16abc872fe9b6

SHA1
e809a0629893b05141e82a62e985a98c68cd4e85

SHA256
f94bee6823469b73c4440ea20a9af9f15e11bec7938923c2ac0fda65a4be79a2

SHA512
964f09e48582f58ec29c4614212d20104c8b41c0ecd022e9516135b6cdda6473326334dad08f01d9efebd6e8d62f47ab6758be22a0206ab16e25dc668ea9da92

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\icmpkifmmhofpahehjkehepglcfdfedf\background.html
Filesize
139B

MD5
13712d90725a94b37427238b66b8e3d8

SHA1
ca9a8e3040100d263cd9de6e5b3bd7849c56e880

SHA256
f3c2db841b04dbdb038b8e943e5c15848e32ed8632174257707a2959885ce3b8

SHA512
37f51f8595ebc0949018a209c689e6b43d72f9caf1f370aae2f20b0d13b5a05e53e5412f8608bae93408329c78033038b4c625152466a244a7435425b28a1f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\icmpkifmmhofpahehjkehepglcfdfedf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\icmpkifmmhofpahehjkehepglcfdfedf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\icmpkifmmhofpahehjkehepglcfdfedf\manifest.json
Filesize
503B

MD5
aa6fc24e028b07a032fbc6f859819dca

SHA1
166f2c578c4f164da313ece0e914e56e053418c2

SHA256
2f026100e6faf41a63ea0c5d289914bfceba28094b32c9a3566a4932b7c71038

SHA512
4f5328b27ace6ec4d786e7369b8a071fedf46f30e0b1d223d8fa9332d1df60914f22b84725e3055c894f027f79f05dd91d47ae5c22bebaad34c0af440f634701

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\lMpKMq4L.dat
Filesize
1KB

MD5
5ba5744ea18c7b926dc2ae4de9617e15

SHA1
1f8c22565bd01d4ed9d16fbe3576929666b02833

SHA256
5785bcea44e836a29e1f8e99069fe5672ff5d1ffa53112ff290e901fa5ffa9ec

SHA512
50eead906c09846c224673e1eed858f98c0661f1f6c1ea79c94b0c1fa347cb6b1f6f5b500ff56073199e0f8603637d74135860efb84f50ac44a27d54ee25839b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b3b6a4a\lMpKMq4L.exe
Filesize
628KB

MD5
335866524cea345ad4d3faac81e5ccae

SHA1
ccbb81287516efe02d019492d0ffed20da5f4ca5

SHA256
df83c79b26feb1cd12fcff4d47f5fbecf2b9771d065a1b5f34dc65bb6acb81db

SHA512
c37d6abfd4372e454ed636c288148843e5120555a290e256968d995bfb6027d7b04a7bcaa518b9a65ed79bc1365e1327b0e761dc664bc41c630261970267486f

Download Submit
\Users\Admin\AppData\Local\Temp\5b3b6a4a\lMpKMq4L.exe
Filesize
628KB

MD5
335866524cea345ad4d3faac81e5ccae

SHA1
ccbb81287516efe02d019492d0ffed20da5f4ca5

SHA256
df83c79b26feb1cd12fcff4d47f5fbecf2b9771d065a1b5f34dc65bb6acb81db

SHA512
c37d6abfd4372e454ed636c288148843e5120555a290e256968d995bfb6027d7b04a7bcaa518b9a65ed79bc1365e1327b0e761dc664bc41c630261970267486f

Download Submit
memory/840-56-0x0000000000000000-mapping.dmp

Download
memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads