d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8

Analysis

max time kernel
123s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8.exe
Size

776KB
MD5

e0b7e58339cdec6d47feb7f67e1dd346
SHA1

3bb278b623bf1d705aec6cab2fb60812c97af1b8
SHA256

d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8
SHA512

569d0752f6cdb078c7f152fef23562c618b91323de449300926ad1d6a0145db9d01d4b91a7c1f3322c40308c6c010fb412e49a4dccef73c2cb5a528933aba327
SSDEEP

12288:h1OgLdaOxaIWZE51JRPG+iqdl3x4sOA9A9hi3+GVa5u:h1OYdaOQI6E5REGb4sp9whi3+GV9

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1580	810hXXVHg4Tp38S.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\idekebppepkccopbcbkigjjcoomacedp\2.0\manifest.json	810hXXVHg4Tp38S.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\idekebppepkccopbcbkigjjcoomacedp\2.0\manifest.json	810hXXVHg4Tp38S.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\idekebppepkccopbcbkigjjcoomacedp\2.0\manifest.json	810hXXVHg4Tp38S.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\idekebppepkccopbcbkigjjcoomacedp\2.0\manifest.json	810hXXVHg4Tp38S.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\idekebppepkccopbcbkigjjcoomacedp\2.0\manifest.json	810hXXVHg4Tp38S.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	810hXXVHg4Tp38S.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	810hXXVHg4Tp38S.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	810hXXVHg4Tp38S.exe
File opened for modification	C:\Windows\System32\GroupPolicy	810hXXVHg4Tp38S.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1580	810hXXVHg4Tp38S.exe
1580	810hXXVHg4Tp38S.exe
1580	810hXXVHg4Tp38S.exe
1580	810hXXVHg4Tp38S.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1580	1780	d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8.exe	82
PID 1780 wrote to memory of 1580	1780	d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8.exe	82
PID 1780 wrote to memory of 1580	1780	d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8.exe	82

C:\Users\Admin\AppData\Local\Temp\d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8.exe
"C:\Users\Admin\AppData\Local\Temp\d2db21a72e72af9e55fc8d88b2bfb56968061105971e7a95f5b9a60cd15c61a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\810hXXVHg4Tp38S.exe
  .\810hXXVHg4Tp38S.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\810hXXVHg4Tp38S.dat

Filesize
1KB

MD5
b9bf5bc2ff168c98db355d5a12a1795c

SHA1
b7744d5c51222a2d227bc0e6ae394a0aad1e0dcb

SHA256
6e71c74573eaab3a42cc21feb8035bee48b52255deb85ddfabaee97170e9469f

SHA512
14f25ec95d1ae8f984e8ec3c0a7a3e978f9898b874a2588ff33ad38d7c45842d5048842a384323349b4945518c7855bc6f607bfa82aa3f8570c38ba2a62b8689

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\810hXXVHg4Tp38S.exe

Filesize
618KB

MD5
1f6c233b6bd46db7ed2e62ea5a824bf6

SHA1
d7f27647c97fc8b832463335df28fe750a4aebb2

SHA256
4548be95d5d9ea78c9cc37eba06f8c30b23da2e60392dabd2f8fb0082719475b

SHA512
af26f7ee482193a1cc4a16edba3daa9f8593cf06b70d14d043e92e2fdca86b097f8a7e93bdf97ba1c3cd760aa18a8080088d7d502bcf58ff0b83f9275c88bd9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\810hXXVHg4Tp38S.exe

Filesize
618KB

MD5
1f6c233b6bd46db7ed2e62ea5a824bf6

SHA1
d7f27647c97fc8b832463335df28fe750a4aebb2

SHA256
4548be95d5d9ea78c9cc37eba06f8c30b23da2e60392dabd2f8fb0082719475b

SHA512
af26f7ee482193a1cc4a16edba3daa9f8593cf06b70d14d043e92e2fdca86b097f8a7e93bdf97ba1c3cd760aa18a8080088d7d502bcf58ff0b83f9275c88bd9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
e811594df7471793b3cf44ed370b0dfb

SHA1
e761268ba077e6ca833565bc60431ad597eaf04a

SHA256
8f2a336d3c7d53d15341edac17fbbae6de5254375fee9715553442ef73c4f879

SHA512
306474da49d0b7b5a1851a899a13cd14ba2ea2f2dfe4b0fbb7cdfc19fed04ffdb168064342e93cadf3ba23b4fce8bfcdbb29bd008654a0c9e6ead90a9caeaf3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
44d377b4a73fff61a5c458b035035544

SHA1
7a001f4ed62f8c06fac0a0ede9c8251042cd7826

SHA256
f7fba9b37383bacb2828f38d3558ee215d1af0617fed80bd2fa6873e4a491015

SHA512
0d1e4a64cccb47cd4afb00b1071c89b0ae285efb22e7c60bd98ac78880a74881fad1c79a794ac663fb159c554eb215e67a57596e365c15b3285863f05f41b364

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\[email protected]\install.rdf

Filesize
593B

MD5
2f7addf658efed91325c8dbc1c054ce8

SHA1
1edccdd1bef706f5f4a8db54dc2c5f9104579f69

SHA256
b3fde061837fc9db79f2c138756e8eae50fbf193f7d792673a9fd19cc65d40e7

SHA512
38f25dcc760b139a82ef5f747d6ce5a14801b38ca5792c968e9b0cec6184d3c67737d5590f3b7992bbb02a2e616194a1cc9ecd0b317dccdbdb31bc4cad51b5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\idekebppepkccopbcbkigjjcoomacedp\background.html

Filesize
140B

MD5
5fe36d13ffac413034e464c645e812ed

SHA1
6801a392ea7f50a7b4d8d16bd68396fd0d16ca4b

SHA256
1604e0da33de75118187cf07f387a2d65262a65ef0fac4d146f729b418bb5cd8

SHA512
afe18c9513d6496debb42073227dcc59d981cd0937f2a605d47195e371eeef3cbaa373ef9477410d2d0c5885f2b15bd3305b1413b9c3bedc497a0ef21503f830

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\idekebppepkccopbcbkigjjcoomacedp\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\idekebppepkccopbcbkigjjcoomacedp\ilB.js

Filesize
5KB

MD5
30cb73f272dc5590036ed1bcf4763917

SHA1
2fdec1437bbec79ef9f9f922862147db56947ca1

SHA256
5a1447995f3b56830f094a6aa3ccc5f5a0ee84e02785f76e7f20c613d9951630

SHA512
de404d0e26b3177cbd6f7870bb4f4467e5801a6d40d820f908cab0cb5875905e17dcb8148c29da8639a83a43f204dd652a4588d1467b42cde18bd3ccd86a11d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\idekebppepkccopbcbkigjjcoomacedp\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC48D.tmp\idekebppepkccopbcbkigjjcoomacedp\manifest.json

Filesize
499B

MD5
5e163ab7a380e500fd8fba83656fc81d

SHA1
82d0120edd810dc9a3abe2c6e521f003cce37db9

SHA256
12510ebb4212d6237a973c11c0f3ae5e21e746ab51f7dbbab7284eb4f802c0a1

SHA512
3fc93afc937c5589df9d93c2cc9faf83ca67495cb7772c3a4f7e0e1b609f3db6a458d8ee0f751f7b26df60e121a006e53d9b20829152d8bed4ebfe0e2ce86c32

Download Submit