Analysis

  • max time kernel
    9s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 04:48

General

  • Target

    d73633390131147c8835192b03e66fd62da1baddce4628d61fb805548d35082a.exe

  • Size

    780KB

  • MD5

    898040893f60052954e311bc272091ff

  • SHA1

    ab1caaa9ca69afb6be92ee61836307858061d0fa

  • SHA256

    d73633390131147c8835192b03e66fd62da1baddce4628d61fb805548d35082a

  • SHA512

    52cc7f184920338b8f5b1ab68514262440a40f1fba62ce77598fa9e3a3b780856beba7648d3bfc1f71a53829381ee8f43ed4a30158cabc85aebeb8fd4d8956d2

  • SSDEEP

    6144:h1OgDPdkBAFZWjadD4s5JcpukdtqCo5imi5SIbSocpzWzZ+v9Z94Aq9SDkncvxVc:h1OgLdaOYSConAwWcv9nq9JcjToFM4tn

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d73633390131147c8835192b03e66fd62da1baddce4628d61fb805548d35082a.exe
    "C:\Users\Admin\AppData\Local\Temp\d73633390131147c8835192b03e66fd62da1baddce4628d61fb805548d35082a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\IWeLuuV4Zpozv4A.exe
      .\IWeLuuV4Zpozv4A.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1140

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    e36cd7021e7246f07b16eeaedbf9fff8

    SHA1

    7da19efc91fe38760d0ac2981870e1ec7dc268e3

    SHA256

    82d1fc8e667256edd206573bf2fd6ce95785256b52333a6af888dae2f6046e64

    SHA512

    3ae056a8bf858cfc8229f90789e098001d52f52ce8b9888ef2a37eb7d0dd4d3d5ea043cb072088ef6d8850f347a2f12d906080e3cc2dff06fca5e6aa85a2128b

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    b11ee978d98bc0e348c0a96b3b2dc469

    SHA1

    f2f3085fae8479ebe35b9f89181555b259423302

    SHA256

    7c7b94a12a3635183274b85e267edc9ab0dd83946d622c74cdb5ea042f99197e

    SHA512

    7df45bcb059481a8e4d1d2d9dd2ab1e874c59abdb17fcccf7f1b1f42053856d3bd30b18e099cca115648661b07799286098ee1a12913b6d017cdff4c3efa8325

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\[email protected]\install.rdf

    Filesize

    593B

    MD5

    34a4e117c2c78de0cea576904165bc8e

    SHA1

    c157cae79a488564a026880a630c78e7ddfe0ec9

    SHA256

    baf7a83b4122402a731cfeca4f1f7522390e7c6631ef5d8ba84a6fa16f9204d4

    SHA512

    ad0fbca678102d60db37f2d16dc20484655089f9e0197a125aa8fe95fee8882dd43e11f837bbb74409a4a0b82101aaff81ffa7e5362f08bf80ebea824007a93d

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\IWeLuuV4Zpozv4A.dat

    Filesize

    1KB

    MD5

    62d03067a601bf348bc17cc3dfacdbfa

    SHA1

    f2701ce6b68549d467b063017fbc19bf415649cd

    SHA256

    6c63e9a82a3f678d2c3f47689c7a1cb24199c2ac889ce61f057873f8009de7b6

    SHA512

    9859724e4973e01c7122a3205f22280380bff838e5dee1861ccd20601f0e93cd13718f658c54f2d7daddc1e0aee2ab5d3e03343ca4731f366d39cea0e314aba6

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\IWeLuuV4Zpozv4A.exe

    Filesize

    623KB

    MD5

    92a70e40452d88d8c4b46f2ad8361977

    SHA1

    162c9ed1873fca1ef6ab9a2234a2812a203d6b56

    SHA256

    e61d40631449eb3f098a3bde542a0f87fc6f715cfcba919777e299e9ab12c1b8

    SHA512

    ef3aab2f1c816909878f6292bf0c2c4217c086a0bd39e936f8f2df19f2c2a16fbe8354d49048feddffa8e8e1ac7e3063b84fbaf0bdec7024494a87f807269e81

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\goknckhhjebaagimmpeekiepciajnkoi\background.html

    Filesize

    141B

    MD5

    af116281f39ace07adea40ac12eef159

    SHA1

    e1128be5a56a8ece150a3ffb72525cd5d528c945

    SHA256

    733637c1afd27486f42d1527c68fe2b118876ac7c815ce3f88b034d4067a85a4

    SHA512

    049fa48062af3f156c621e16798fe654c6972f73fbd9ec7cea09c395e09caf32e14c1fae3caa3d20ac6689ab5703c5140bd93261a28f01d2b3ddb612f76bb442

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\goknckhhjebaagimmpeekiepciajnkoi\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\goknckhhjebaagimmpeekiepciajnkoi\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\goknckhhjebaagimmpeekiepciajnkoi\mafa.js

    Filesize

    5KB

    MD5

    bb4f811aab46f1e613ee60ae7ef5588e

    SHA1

    78738a42ca1cf24384c2f2b66f15d40e87ffb074

    SHA256

    f231f8930e782eac3e1d4aaefa4bc84b28e757422cfa1fa5b4871091c078673c

    SHA512

    bab9e63d65da347fa2aaf8312b1e42b8eb3481e4535585b093c0bbca00b0a532b2964e3bd62dac46e6605735166ee89af7dfa7f946086eb79fb7d29226778382

  • C:\Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\goknckhhjebaagimmpeekiepciajnkoi\manifest.json

    Filesize

    499B

    MD5

    f768b75729fd720b48a6c849796d8df4

    SHA1

    6771a550abe693c5b0515d6e7f78077eb85de1a5

    SHA256

    8fddef7b797480f0c5559c6d86c0f8894254c6decb881f009b3e3df0ec6421ee

    SHA512

    9f194b042723fda282fd1c6099f8108129e3c603e7d08842719d6c42557c0a1274f9b64bd7e4320aa0cc5a92713b62dbc45360105f92507a1e199d927615cd57

  • \Users\Admin\AppData\Local\Temp\7zSDC0E.tmp\IWeLuuV4Zpozv4A.exe

    Filesize

    623KB

    MD5

    92a70e40452d88d8c4b46f2ad8361977

    SHA1

    162c9ed1873fca1ef6ab9a2234a2812a203d6b56

    SHA256

    e61d40631449eb3f098a3bde542a0f87fc6f715cfcba919777e299e9ab12c1b8

    SHA512

    ef3aab2f1c816909878f6292bf0c2c4217c086a0bd39e936f8f2df19f2c2a16fbe8354d49048feddffa8e8e1ac7e3063b84fbaf0bdec7024494a87f807269e81

  • memory/940-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

    Filesize

    8KB