Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe
Resource
win7-20221111-en
General
-
Target
63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe
-
Size
2.1MB
-
MD5
cf00119f9d6d3bd2862e14f315c73e9e
-
SHA1
143d41f05de812a513ec6aaafc9e37b88839a8b2
-
SHA256
63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1
-
SHA512
2470e7ff2ed90d08f82d9462a70170ea11aaebbf64f20ac4057eddcb7b7a3c46217d99ad46c5cf3896830954fff35a190e84657b6c6f147b6977c0658cef0849
-
SSDEEP
49152:h1OsIAxPqbaJ0CqWfTAeP20icuFMDoiXrBSdCIlE05XwjXr3H:h1OtAxib7CqWfTAeP2vaDhtSdpW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
7CL8Rg2F1i26EBJ.exepid process 2368 7CL8Rg2F1i26EBJ.exe -
Loads dropped DLL 3 IoCs
Processes:
7CL8Rg2F1i26EBJ.exeregsvr32.exeregsvr32.exepid process 2368 7CL8Rg2F1i26EBJ.exe 4548 regsvr32.exe 616 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
7CL8Rg2F1i26EBJ.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngfimepemhcbhnbjofaajhblgnbodbea\200\manifest.json 7CL8Rg2F1i26EBJ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngfimepemhcbhnbjofaajhblgnbodbea\200\manifest.json 7CL8Rg2F1i26EBJ.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngfimepemhcbhnbjofaajhblgnbodbea\200\manifest.json 7CL8Rg2F1i26EBJ.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngfimepemhcbhnbjofaajhblgnbodbea\200\manifest.json 7CL8Rg2F1i26EBJ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngfimepemhcbhnbjofaajhblgnbodbea\200\manifest.json 7CL8Rg2F1i26EBJ.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exe7CL8Rg2F1i26EBJ.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} 7CL8Rg2F1i26EBJ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 7CL8Rg2F1i26EBJ.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 7CL8Rg2F1i26EBJ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 7CL8Rg2F1i26EBJ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
7CL8Rg2F1i26EBJ.exedescription ioc process File opened for modification C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.tlb 7CL8Rg2F1i26EBJ.exe File created C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.dat 7CL8Rg2F1i26EBJ.exe File opened for modification C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.dat 7CL8Rg2F1i26EBJ.exe File created C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dll 7CL8Rg2F1i26EBJ.exe File opened for modification C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dll 7CL8Rg2F1i26EBJ.exe File created C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.dll 7CL8Rg2F1i26EBJ.exe File opened for modification C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.dll 7CL8Rg2F1i26EBJ.exe File created C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.tlb 7CL8Rg2F1i26EBJ.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7CL8Rg2F1i26EBJ.exepid process 2368 7CL8Rg2F1i26EBJ.exe 2368 7CL8Rg2F1i26EBJ.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe7CL8Rg2F1i26EBJ.exeregsvr32.exedescription pid process target process PID 4624 wrote to memory of 2368 4624 63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe 7CL8Rg2F1i26EBJ.exe PID 4624 wrote to memory of 2368 4624 63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe 7CL8Rg2F1i26EBJ.exe PID 4624 wrote to memory of 2368 4624 63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe 7CL8Rg2F1i26EBJ.exe PID 2368 wrote to memory of 4548 2368 7CL8Rg2F1i26EBJ.exe regsvr32.exe PID 2368 wrote to memory of 4548 2368 7CL8Rg2F1i26EBJ.exe regsvr32.exe PID 2368 wrote to memory of 4548 2368 7CL8Rg2F1i26EBJ.exe regsvr32.exe PID 4548 wrote to memory of 616 4548 regsvr32.exe regsvr32.exe PID 4548 wrote to memory of 616 4548 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe"C:\Users\Admin\AppData\Local\Temp\63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\7CL8Rg2F1i26EBJ.exe.\7CL8Rg2F1i26EBJ.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.datFilesize
6KB
MD51004803e5c5101d7f5052c63f9aaac39
SHA1ff1e7e40c0665f9135f1751037e3eb49303195b0
SHA25617a9d73e210466ea8b32bccb888cfff6cc1ac92dcd7e56fd9a97c53a6154198a
SHA51295d6df3ed9108a0d4220280fb3e5cabbf67fc986df32090a8890d45bedceac4c410e39517fd4c714cd5efb7fddc6e63a6661cdc026b3025e5871a8b00b37cd20
-
C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.dllFilesize
617KB
MD5840d829dddf8d035522e4f3547f72799
SHA11f669f414a0935ef806bdb8a93d2755f00104519
SHA256a8405b5162305f768093c227ad9ece6ddd74f6dfe17fd0878a4e64e61e125d42
SHA512e447ed7f6bbaacd8523984bae1584f39c4c38e93abd43d4e25c8056143d3228a3993d7aab8fd92d2e6baf0157a1d8638a1254eed037f3eb64250b6ca586913c7
-
C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dllFilesize
697KB
MD509b1827343abfccf344d2b04268c1b87
SHA11c60bbd56c0b33be582c3dac053e9b28b94d588b
SHA256a9181af1ead8778d27a22e862145aa5e1dd7ac40cf6e994f8c6b1ae7b58f302a
SHA512cb4ac4ff93405372a7ab65e1910d58f88a30c9b4d62c06b84fd3fd5f51ca10459c351efcc394418e27aafa27e87bd1a359d20006804da8f171b37cf2fd26f965
-
C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dllFilesize
697KB
MD509b1827343abfccf344d2b04268c1b87
SHA11c60bbd56c0b33be582c3dac053e9b28b94d588b
SHA256a9181af1ead8778d27a22e862145aa5e1dd7ac40cf6e994f8c6b1ae7b58f302a
SHA512cb4ac4ff93405372a7ab65e1910d58f88a30c9b4d62c06b84fd3fd5f51ca10459c351efcc394418e27aafa27e87bd1a359d20006804da8f171b37cf2fd26f965
-
C:\Program Files (x86)\Browser Shop\K6ibq69fa2Esvb.x64.dllFilesize
697KB
MD509b1827343abfccf344d2b04268c1b87
SHA11c60bbd56c0b33be582c3dac053e9b28b94d588b
SHA256a9181af1ead8778d27a22e862145aa5e1dd7ac40cf6e994f8c6b1ae7b58f302a
SHA512cb4ac4ff93405372a7ab65e1910d58f88a30c9b4d62c06b84fd3fd5f51ca10459c351efcc394418e27aafa27e87bd1a359d20006804da8f171b37cf2fd26f965
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\7CL8Rg2F1i26EBJ.datFilesize
6KB
MD51004803e5c5101d7f5052c63f9aaac39
SHA1ff1e7e40c0665f9135f1751037e3eb49303195b0
SHA25617a9d73e210466ea8b32bccb888cfff6cc1ac92dcd7e56fd9a97c53a6154198a
SHA51295d6df3ed9108a0d4220280fb3e5cabbf67fc986df32090a8890d45bedceac4c410e39517fd4c714cd5efb7fddc6e63a6661cdc026b3025e5871a8b00b37cd20
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\7CL8Rg2F1i26EBJ.exeFilesize
634KB
MD539bca0c0295e43a1d256f93c4bc41a7d
SHA1163629228f4ad397c594ae4acc1162d2990f7d5f
SHA2562e46c5d7d549885057d92525f35b60a19cb428600a397245e5f6ce0238b5e1cd
SHA512e16570bea11aa8680f4e547f099e8c099c1654e6a3060fca871a42dffb9e256811f5aa9bba9f00dc14b218ad32b56c916987b3a270893540a0992f832bcf2a4d
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\7CL8Rg2F1i26EBJ.exeFilesize
634KB
MD539bca0c0295e43a1d256f93c4bc41a7d
SHA1163629228f4ad397c594ae4acc1162d2990f7d5f
SHA2562e46c5d7d549885057d92525f35b60a19cb428600a397245e5f6ce0238b5e1cd
SHA512e16570bea11aa8680f4e547f099e8c099c1654e6a3060fca871a42dffb9e256811f5aa9bba9f00dc14b218ad32b56c916987b3a270893540a0992f832bcf2a4d
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\[email protected]\chrome.manifestFilesize
35B
MD514932d3460c832b4043c4c99c691645b
SHA1a7f101fc5ecae308f491703cc5be4274ec52797e
SHA256068fc06b9b6581b6ea224ffd6b70cc94d61db9ae9ed8983e443b32e0e92db523
SHA51216d6f76676e8cc9cc0eba6e34c3c7d5d84f6705d7ba602d6707ef4d3a38cb6fb6d702559892fbdda58b5dd268d18cdad68d9c7b9fe3efa08e8fbe400642b46c0
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\[email protected]\content\bg.jsFilesize
7KB
MD557bf7d869981e83b1a033ed145d5dc21
SHA1ab16f36b43849a78a1bc0c29657df9113957fa10
SHA256c75b970a4c79a9d168efba9262873708ac564cf5e3109e3933bef9eacee4d7af
SHA5128d09ce52f520036c795959eb51d30d9979a17e8f053aca624f29a97638722263c0bf85e2888bbd00384ef08abc239281aeeca961aaebddf6de5f515eca8b65b7
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\[email protected]\install.rdfFilesize
597B
MD5e42527e562014b6008eb3350d838d408
SHA154d0a96bea1308603c969b4f691a2b7f88526e06
SHA2561974e5dc14d5711d23895247fe451330b361cee25597d61c0123a511a09b8700
SHA512288fc5148fa713184adbcf69b47c5f01346bbfc330a62a047e4244d7aff385da4a0cb435ff7796d943845d42bee269ec0966784c967a9348e49ff50f141039c1
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\K6ibq69fa2Esvb.dllFilesize
617KB
MD5840d829dddf8d035522e4f3547f72799
SHA11f669f414a0935ef806bdb8a93d2755f00104519
SHA256a8405b5162305f768093c227ad9ece6ddd74f6dfe17fd0878a4e64e61e125d42
SHA512e447ed7f6bbaacd8523984bae1584f39c4c38e93abd43d4e25c8056143d3228a3993d7aab8fd92d2e6baf0157a1d8638a1254eed037f3eb64250b6ca586913c7
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\K6ibq69fa2Esvb.tlbFilesize
3KB
MD56fb4d3c40d62e1e378e92280f2cd93a4
SHA1cdcd20abfab5c8f24b0bf2e24b43930a33b4d147
SHA256ffe3ee2134494c6e175cf01e0fc518402384a1f79a46a37f441e6e3c74183983
SHA512960ecc2ce3d9ee0a828780d0770a4966211a55c8587e36b460c3c5d2bf7a338bd538c13bb07e93b647b5c1056fc0c14f90cf59a4b13508350922cda38ab6538d
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\K6ibq69fa2Esvb.x64.dllFilesize
697KB
MD509b1827343abfccf344d2b04268c1b87
SHA11c60bbd56c0b33be582c3dac053e9b28b94d588b
SHA256a9181af1ead8778d27a22e862145aa5e1dd7ac40cf6e994f8c6b1ae7b58f302a
SHA512cb4ac4ff93405372a7ab65e1910d58f88a30c9b4d62c06b84fd3fd5f51ca10459c351efcc394418e27aafa27e87bd1a359d20006804da8f171b37cf2fd26f965
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\ngfimepemhcbhnbjofaajhblgnbodbea\background.htmlFilesize
141B
MD58e066a65bd5fa2f689622b2e9569efae
SHA1a5e79eae79c4b9ca00c5804a955748f2b9f2c5bf
SHA2560cd63a5c0b04c313f97bcdde3747357a75c5dff9bf116b84699b63e624535177
SHA5127acc6194871c354e201b203d22a7cac7ddab9d4b8dbf0227d03837bd21bb41c36df242f608e9d837b64abfac96faefc0ea322876ff4024ea8ef0ae35dda46b1c
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\ngfimepemhcbhnbjofaajhblgnbodbea\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\ngfimepemhcbhnbjofaajhblgnbodbea\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\ngfimepemhcbhnbjofaajhblgnbodbea\manifest.jsonFilesize
504B
MD5d532994175ac6e4e8fea2ae07edef6ff
SHA15646eab3cebc8b0a804103b63f08a63db784a77d
SHA256f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d
SHA512ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb
-
C:\Users\Admin\AppData\Local\Temp\7zS7F37.tmp\ngfimepemhcbhnbjofaajhblgnbodbea\zsAX.jsFilesize
5KB
MD554e6e8f55b3a779a27bafe41a79e81ca
SHA16943a4bef39948c4ac70e32e356a2960444f4ce0
SHA256f3d9b4f56802b5512ac730697db650da3b684466cbe4a4afa04be953ddc00906
SHA51215079453bb94484a7841c0ffdfc9fb7a1f401ffe52de041bd9c40b0bf20ca9a71bad6609d41cfdb6c3ec68efb4c69d098bd8c3e69b490b5b9304ad790e495f73
-
memory/616-152-0x0000000000000000-mapping.dmp
-
memory/2368-132-0x0000000000000000-mapping.dmp
-
memory/4548-149-0x0000000000000000-mapping.dmp