Analysis

  • max time kernel
    140s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:37

General

  • Target

    e73fcaae5c97182a912dad6b4540810053f5afec86623c7b22a3ec933511fd52.exe

  • Size

    1.9MB

  • MD5

    6f53d02565f64b07e20c199ec898028b

  • SHA1

    a5ddd57410306d7acf3117fb684c14f5b12c8d14

  • SHA256

    e73fcaae5c97182a912dad6b4540810053f5afec86623c7b22a3ec933511fd52

  • SHA512

    a7529930d8bfda5f450c0a721e61a4af2c64a4fb0ae02c9d81712c8bdb8bf435623892c7a4efe1c2b41bfcb6f29735ad79e3988934aaf64c74d716cc6e444154

  • SSDEEP

    49152:NHa4eb87fT0efaxJAto9/7miqOwRPaZQs3qQPeGs:5a347fApoo9/7mi+RPa

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e73fcaae5c97182a912dad6b4540810053f5afec86623c7b22a3ec933511fd52.exe
    "C:\Users\Admin\AppData\Local\Temp\e73fcaae5c97182a912dad6b4540810053f5afec86623c7b22a3ec933511fd52.exe"
    1⤵
    • Drops Chrome extension
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4364
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:4140
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:1812

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4364-132-0x0000000002890000-0x0000000002933000-memory.dmp

        Filesize

        652KB