e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4

General

Target

e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4.exe
Size

770KB
MD5

909e4be21124cb43148792de6fbd0b81
SHA1

e1fffa7f7b74cfc076d6690bdce9a3899598c368
SHA256

e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4
SHA512

9eb212379ce826c964b1a349838e3888297119593afd4d210b32736d6d2966f37d8cb4465e1641da526573e1f09a6f3605e12fb4ff383be20085f1f6fa23b5bb
SSDEEP

12288:h1OgLdaOj+f65f+YOfY0bU5phYwX6nK3LbbSLkUGp:h1OYdaOj+C5fz+YRUwXV3Lbu4Dp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5000	Qilb1kM0H0ddZPz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\177\manifest.json	Qilb1kM0H0ddZPz.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\177\manifest.json	Qilb1kM0H0ddZPz.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\177\manifest.json	Qilb1kM0H0ddZPz.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\177\manifest.json	Qilb1kM0H0ddZPz.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\177\manifest.json	Qilb1kM0H0ddZPz.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 5000	4760	e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4.exe	79
PID 4760 wrote to memory of 5000	4760	e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4.exe	79
PID 4760 wrote to memory of 5000	4760	e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4.exe	79

C:\Users\Admin\AppData\Local\Temp\e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4.exe
"C:\Users\Admin\AppData\Local\Temp\e94a79d2f26ee6535c968bf44e422528af80d769cfb22753d6eb4274bdef94f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\Qilb1kM0H0ddZPz.exe
  .\Qilb1kM0H0ddZPz.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  PID:5000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\Qilb1kM0H0ddZPz.dat

Filesize
1KB

MD5
b82f81a1f3392fd81dfa8fc5c163679f

SHA1
b75cea05f14a7d304dd7c2bc86f75213793bfb5b

SHA256
b9744f056e17329b0fd4a5a40fe2ae9e62b9d0fdefe7588627d679fff22ce689

SHA512
8bcaa76f8de4c8d22fcdc322cfcf9b33ed82e78f794abf98aa59aea2fd0ea55d094f1063f5d77eb0dfd229c4790e66487fdb2970e493702746453257da40c8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\Qilb1kM0H0ddZPz.exe

Filesize
623KB

MD5
3b3e9f85b1e1d1defb4813cb1676b553

SHA1
17a064e28b670d6d4e579ac078a81e7334704b58

SHA256
26fc2e717907241142895bb38734755ebb1ca82f1d23f48e09ec0d75cd4ad381

SHA512
0f7d3df630b73820490a0d767707c69f5cbb94265b67a202c6f652e601ba970d1257583cf6082aa9fea97b10e7c0a40d0ac3947599602964b14a492c7452da36

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\Qilb1kM0H0ddZPz.exe

Filesize
623KB

MD5
3b3e9f85b1e1d1defb4813cb1676b553

SHA1
17a064e28b670d6d4e579ac078a81e7334704b58

SHA256
26fc2e717907241142895bb38734755ebb1ca82f1d23f48e09ec0d75cd4ad381

SHA512
0f7d3df630b73820490a0d767707c69f5cbb94265b67a202c6f652e601ba970d1257583cf6082aa9fea97b10e7c0a40d0ac3947599602964b14a492c7452da36

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\ciagpekplgpbepdgggflgmahnjgiaced\TMkSDH.js

Filesize
6KB

MD5
c5d91d2ce18ddc2a1da6a3ce8c299a15

SHA1
382b29f09e69318e92df086b47f1378293dbaed9

SHA256
677222d7ae419d85f63ff1824feda2fc25efcc9415d4a34a3484003a015f4f28

SHA512
c5382ec407322a13b0c1850bde5b6c72d9300ff3e80f97cbb4519950457f71d9b7f55e15c263b9cbfb712e7faeb40f2b93b4691023abf62425ce900620c36f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\ciagpekplgpbepdgggflgmahnjgiaced\background.html

Filesize
143B

MD5
a2ed03bf1e2a0983120957b2fe6cec37

SHA1
8d460e07baac899ec3a0fae7c199c568d114e852

SHA256
40b31e02e9940960acf4662300c3a8bf072cebb6e476ae16ddfcdf38fdb27858

SHA512
743244397044f7e85991dd2393d3dc31a5cf5ed18391694eb34e9d22ca66550862447fdee1ca87f6e1c4a3dd9932f5c8fd8c687164dd8d89377e5a55295b1f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\ciagpekplgpbepdgggflgmahnjgiaced\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\ciagpekplgpbepdgggflgmahnjgiaced\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7A55.tmp\ciagpekplgpbepdgggflgmahnjgiaced\manifest.json

Filesize
603B

MD5
8cd993ae8f078d2fc9d3484c0f3eb9ea

SHA1
b73de5d405b7e299cbc9192e8f562974416fa2b4

SHA256
2cf2e467ba3c8266c66c9698d8fd71927ed03a8b9a917779c43b924e6f478819

SHA512
7e65c9398dbb94ba4297469a13d26cea3cc1656b563bf4b0ee5d43b699388787778595bfcb993c55768947a90ee850b525fb5af60f436e4b8bb5ff325d96b6d8

Download Submit
memory/5000-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing