debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a

Analysis

max time kernel
16s
max time network
102s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:42

Target

debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe
Size

2.9MB
MD5

9fd0da34f0b67e859befbab515278539
SHA1

043ba8613952a487490729d730708364f0c9b6c6
SHA256

debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a
SHA512

b9fd24bd8e53984e3ad86e545bd3efad2fb2cb7a4dc8efa4856ca7f70b6f0cbd307194137b2a05287ef6c006f4eca31cc9bc657329c8e1cb363d36d5b303fd66
SSDEEP

49152:ZtSReSLtvO/jOL3IdN190bZWKHkLR52ypX+rrWuxop4uLCPwg:TlSR3LU90b0uKOypX+rrO

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjocghlclkpgheifflemilcnblodjohg\235\manifest.json	debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjocghlclkpgheifflemilcnblodjohg\235\manifest.json	debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjocghlclkpgheifflemilcnblodjohg\235\manifest.json	debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe

pid process

1980 debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe

pid	process
1980	debe5573669151aec3e560d93cea922e674662a4578027d91d49e394eb3aa10a.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1980-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1980-55-0x0000000002540000-0x00000000025E6000-memory.dmp

Filesize
664KB

Download