Analysis

  • max time kernel
    30s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 04:59

General

  • Target

    93bd581f335684627e541af20949caac30f0e678410a76dda40f221805fd835d.exe

  • Size

    2.1MB

  • MD5

    6c84a367a2f86a7f458e0e5e1e8ca2b9

  • SHA1

    7558b68d3053641467b8b9ffd700e652347493a2

  • SHA256

    93bd581f335684627e541af20949caac30f0e678410a76dda40f221805fd835d

  • SHA512

    07d25c9676c14006d5134eeda18ed4ede2ae20e7857a536ca25a29b0a906fceb4a5fe74a72b8303555f677bc1abc14e53942bcaf7d7305dd358f9e2c37ca1b0f

  • SSDEEP

    24576:h1OYdaO9+C5fz+YRUwXV3Lbu4DR6YV5cSIbmJM9AuigHa3rU+jsvHGv7K3vrOOVg:h1Osr+kjXVXDR6Yl/Erzw7PWMIlI

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93bd581f335684627e541af20949caac30f0e678410a76dda40f221805fd835d.exe
    "C:\Users\Admin\AppData\Local\Temp\93bd581f335684627e541af20949caac30f0e678410a76dda40f221805fd835d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\iWYNByg6dIILTzm.exe
      .\iWYNByg6dIILTzm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GooSave\d5iyUcPy6xafKH.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:780
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GooSave\d5iyUcPy6xafKH.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GooSave\d5iyUcPy6xafKH.dat

    Filesize

    6KB

    MD5

    ebbd0b956b871d498bea28fd0da493b3

    SHA1

    8a5dad784bb5165cc95a44a73c4d93ef9cede64c

    SHA256

    dce6e0abe825ba1852a2bb2023dd3279a9c5958de3cb369254f5429ef27d5804

    SHA512

    8c7a4d7f6420ef84a017fe176707bd13cffddde99bcf060661458007e403751b3a76d2aa619c7158360a8ca4534106935035798a7324b7afdbef2ef20ad93cc1

  • C:\Program Files (x86)\GooSave\d5iyUcPy6xafKH.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    ca08a2a4adc9af8920b0ab970accbe5b

    SHA1

    44bc27369edf6620aa2a9c211eabbe7c1bd447c8

    SHA256

    628ad0aa2478ad1dc4cc6717e5f41ee47101ed64c5e6fcaed138a35a4a83e10b

    SHA512

    6bdb8660f1b4fa6406e5d9db29f397895f71bf7612eba798692e12286a5b98230aa45df4b21a99210dd5e7393178a21991e1c909aaf40ac20bdbbd663dcf90da

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    a64a9057dd33fc6574fe8ae91d14c6c5

    SHA1

    e50590cdd737cd5a2b1489be6df1d44ef89d0833

    SHA256

    68324d6df6aa22c2110223b484b5688bc6a8bf09ee6b2d3ed3f35d15a0b78d50

    SHA512

    ef151d884c675163b7b474a7ade27036fb98e56f948bf3429d41bd2599d3c293134a7f20126f3ad00ecd7648164b7405019448bcde7435620fe1cd4af6897e46

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\[email protected]\install.rdf

    Filesize

    597B

    MD5

    89fe33992fea978e88415a783600fec2

    SHA1

    96f4b1699cb33b66171d07f19f90c297f489a50c

    SHA256

    f8ccdae1ae7e7d5d9e63ac18d9be86408e313fbcfde62e5d59ffdc27b743aaa6

    SHA512

    0e340e4caa8a780723239aca3830df486e66fe47a5211afa0d9a89698980749759712f3fe4a89aa61185f8bf7b493519bba22c0643f00528ed2c1174fa99bdbf

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\d5iyUcPy6xafKH.dll

    Filesize

    617KB

    MD5

    5b02fe261c5832aba1e2b35228934c17

    SHA1

    b30aef32bfc7fb93add291dd7699d209fc3a60c1

    SHA256

    af2632d8ad1a0b0e706f260de79b687cf94855d911bf5fc9d4b7007e256e7a6c

    SHA512

    936b81acb1219be1c18b958f4fc3bd7c5c1ab617fa20e76db165f6ffdb2f674c602c18522980527d84cad7a93dcc79cb222e5e4a8b301298ec141a8b6eb26e72

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\d5iyUcPy6xafKH.tlb

    Filesize

    3KB

    MD5

    934268ece04f6de7c76bfed3478cf1d4

    SHA1

    a4e0ca22b9db6bfcf061d76e8101ef7559813954

    SHA256

    ab54518451a446e00679b2dbecd9285d8a96841ad27df558a2e0b6ce55252b8c

    SHA512

    043fa5fd301b7bbdb6f9ee7766c46dfe5da897b7f7dd164372326416fdb1b7cb3c3809f1293b987077ded2664daf123f9bb217cb12c7d9bf923b1df6a2afccea

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\d5iyUcPy6xafKH.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\dlipmbcfphpgcagnajajghipfcnhomck\background.html

    Filesize

    146B

    MD5

    1e9960ca0cc7e223be8408e50500506c

    SHA1

    582f4961c6ca283b3350074ad72c7dc3ab0a21b9

    SHA256

    1cc7fc85489520077dd4cdebd744124e691898fb40b325474728b95578215d67

    SHA512

    0239d0b88dbc834ec98b86a45b4b70ca0c9255bdf496da216e3fd51f46ad6b9a903d09b34a7b12e5426f7769657cedcd258ba36281bff818047af10d6d171744

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\dlipmbcfphpgcagnajajghipfcnhomck\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\dlipmbcfphpgcagnajajghipfcnhomck\hXpbbRoaJ.js

    Filesize

    5KB

    MD5

    a1d8c654b03e81bc1100b24ba73992f9

    SHA1

    c79dc23256edc56c99f8d2848d080752b758a579

    SHA256

    a259e4f93f2b9741ec3164f5190f274373ff39a595680eaca92fd39b99e3a1d2

    SHA512

    46899f8bbaf41c54504146e2c4d0071a482424686b783fb2614cc379c8d6a5f27f106a2c938ed21ce2bbf7c1bb028f5ea5a384d11df711c1df5809e8f83a67bc

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\dlipmbcfphpgcagnajajghipfcnhomck\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\dlipmbcfphpgcagnajajghipfcnhomck\manifest.json

    Filesize

    499B

    MD5

    2bafae0ea4ab5ac51958f72d544ef543

    SHA1

    4a4665d6b13fbba59d92c908b8fc30aac3bedd08

    SHA256

    9c47ef92b7f138a1487632f023fb3f9ff2c379b29c627b716707b162ae56f473

    SHA512

    1f76f2b5423a040f29ecbc58e257c336faade2f80fc41917d165d02989858057508ed0cf5c7eecd12b6238885331f27d4f05d61ec0334200f6c17f2e4974b72f

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\iWYNByg6dIILTzm.dat

    Filesize

    6KB

    MD5

    ebbd0b956b871d498bea28fd0da493b3

    SHA1

    8a5dad784bb5165cc95a44a73c4d93ef9cede64c

    SHA256

    dce6e0abe825ba1852a2bb2023dd3279a9c5958de3cb369254f5429ef27d5804

    SHA512

    8c7a4d7f6420ef84a017fe176707bd13cffddde99bcf060661458007e403751b3a76d2aa619c7158360a8ca4534106935035798a7324b7afdbef2ef20ad93cc1

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\iWYNByg6dIILTzm.exe

    Filesize

    623KB

    MD5

    3b3e9f85b1e1d1defb4813cb1676b553

    SHA1

    17a064e28b670d6d4e579ac078a81e7334704b58

    SHA256

    26fc2e717907241142895bb38734755ebb1ca82f1d23f48e09ec0d75cd4ad381

    SHA512

    0f7d3df630b73820490a0d767707c69f5cbb94265b67a202c6f652e601ba970d1257583cf6082aa9fea97b10e7c0a40d0ac3947599602964b14a492c7452da36

  • C:\Users\Admin\AppData\Local\Temp\7zS9129.tmp\iWYNByg6dIILTzm.exe

    Filesize

    623KB

    MD5

    3b3e9f85b1e1d1defb4813cb1676b553

    SHA1

    17a064e28b670d6d4e579ac078a81e7334704b58

    SHA256

    26fc2e717907241142895bb38734755ebb1ca82f1d23f48e09ec0d75cd4ad381

    SHA512

    0f7d3df630b73820490a0d767707c69f5cbb94265b67a202c6f652e601ba970d1257583cf6082aa9fea97b10e7c0a40d0ac3947599602964b14a492c7452da36

  • \Program Files (x86)\GooSave\d5iyUcPy6xafKH.dll

    Filesize

    617KB

    MD5

    5b02fe261c5832aba1e2b35228934c17

    SHA1

    b30aef32bfc7fb93add291dd7699d209fc3a60c1

    SHA256

    af2632d8ad1a0b0e706f260de79b687cf94855d911bf5fc9d4b7007e256e7a6c

    SHA512

    936b81acb1219be1c18b958f4fc3bd7c5c1ab617fa20e76db165f6ffdb2f674c602c18522980527d84cad7a93dcc79cb222e5e4a8b301298ec141a8b6eb26e72

  • \Program Files (x86)\GooSave\d5iyUcPy6xafKH.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • \Program Files (x86)\GooSave\d5iyUcPy6xafKH.x64.dll

    Filesize

    700KB

    MD5

    5bdec27c100693ecb0b61cc2555e8505

    SHA1

    771242d417269c2f9150d649f06e6ec8e8bd8cb7

    SHA256

    ca873de4e82bcaefde87f524b1284723ee61e70767bcb9f45f78a2e52547b326

    SHA512

    1b4067351a9912bdd4ad0285470396273563336bad6029c2d05e48fb1fd9971c69115cca1ec46dc7ce37274c7c48a2364498cb180563f7871cd838aebbd8c6b4

  • \Users\Admin\AppData\Local\Temp\7zS9129.tmp\iWYNByg6dIILTzm.exe

    Filesize

    623KB

    MD5

    3b3e9f85b1e1d1defb4813cb1676b553

    SHA1

    17a064e28b670d6d4e579ac078a81e7334704b58

    SHA256

    26fc2e717907241142895bb38734755ebb1ca82f1d23f48e09ec0d75cd4ad381

    SHA512

    0f7d3df630b73820490a0d767707c69f5cbb94265b67a202c6f652e601ba970d1257583cf6082aa9fea97b10e7c0a40d0ac3947599602964b14a492c7452da36

  • memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

    Filesize

    8KB

  • memory/1936-78-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

    Filesize

    8KB