Analysis

  • max time kernel
    141s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 17:02

General

  • Target

    6301c159da07b0919b7e78362199e4fc5ed1496f134a63047af415cfc1e640e2.exe

  • Size

    2.0MB

  • MD5

    21b5b459a81455f789376e6e0709df5b

  • SHA1

    15b235b794c2db0cdc0bd1572575cb4b743f5063

  • SHA256

    6301c159da07b0919b7e78362199e4fc5ed1496f134a63047af415cfc1e640e2

  • SHA512

    47aec573973c5312dae0bde990a3de49320ed8593629bdc175318d93808c915c04b29f65188d531e66af60e05a1787805f14387a60fd0e7223e4c7b43a475357

  • SSDEEP

    49152:cWa4Vbl7fscefaxJAto9/N48uouDUQhDi3eQjeGs:1akR7f7poo9/iamUQ

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6301c159da07b0919b7e78362199e4fc5ed1496f134a63047af415cfc1e640e2.exe
    "C:\Users\Admin\AppData\Local\Temp\6301c159da07b0919b7e78362199e4fc5ed1496f134a63047af415cfc1e640e2.exe"
    1⤵
    • Drops Chrome extension
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4028
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:4912
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:5104

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4028-132-0x0000000002FD0000-0x0000000003073000-memory.dmp

        Filesize

        652KB