56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:10

Target

56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe
Size

2.8MB
MD5

a0ce5cc83d767a1b14d385c3e108b327
SHA1

f342b71e98fdb0ef4eebb726d26c1dae5274de9d
SHA256

56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf
SHA512

98df4118b431a1368649f789e395526f7e7043962963a0b87a9553ec4dd1a8afc0932cf144b184ad657b5b2a54287da037f01fd09be547522dde569df45d7c7a
SSDEEP

49152:WNKRui7cB/vjT7IYL9/90bZaKHkLAhiRMUBt7fiCmgQ:M9iAt7r90bQuKXtu

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggekjaligipajhljkbemifjgmlpcfkao\195\manifest.json	56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggekjaligipajhljkbemifjgmlpcfkao\195\manifest.json	56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggekjaligipajhljkbemifjgmlpcfkao\195\manifest.json	56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe

pid process

1044 56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe

pid	process
1044	56de15534fdb0c9dab89c737c6c9cffcb2ef876e2044b41c19fa9a79ed4786bf.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1044-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1044-55-0x0000000000850000-0x00000000008F6000-memory.dmp

Filesize
664KB

Download