69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 05:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe
Size

930KB
MD5

1e72a593bdc6b6433ef3af01dc84f7f7
SHA1

f5030ffb8efdf73debfeccfaea401342b448e382
SHA256

69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee
SHA512

0858d00777eded5f13aaa3eff2c8ad96f0cdf6990569ba213845e6624f4e0812d6ffc0f6fdb8aa1c1ef66da664bcb0b3a884efd20c999c8f3089f5f286eed9a6
SSDEEP

24576:h1OYdaORMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfE:h1OsDMWyUQ+GUVFIcHPvpfE

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
696	telDWAi9JINespV.exe

Loads dropped DLL 1 IoCs

pid	Process
1096	69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\epklccaddnppcemlegjbcahkoigohcha\2.0\manifest.json	telDWAi9JINespV.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\epklccaddnppcemlegjbcahkoigohcha\2.0\manifest.json	telDWAi9JINespV.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\epklccaddnppcemlegjbcahkoigohcha\2.0\manifest.json	telDWAi9JINespV.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	telDWAi9JINespV.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	telDWAi9JINespV.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	telDWAi9JINespV.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	telDWAi9JINespV.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe
696	telDWAi9JINespV.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	696	telDWAi9JINespV.exe
Token: SeDebugPrivilege	696	telDWAi9JINespV.exe
Token: SeDebugPrivilege	696	telDWAi9JINespV.exe
Token: SeDebugPrivilege	696	telDWAi9JINespV.exe
Token: SeDebugPrivilege	696	telDWAi9JINespV.exe
Token: SeDebugPrivilege	696	telDWAi9JINespV.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 696	1096	69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe	26
PID 1096 wrote to memory of 696	1096	69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe	26
PID 1096 wrote to memory of 696	1096	69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe	26
PID 1096 wrote to memory of 696	1096	69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe	26

C:\Users\Admin\AppData\Local\Temp\69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe
"C:\Users\Admin\AppData\Local\Temp\69e65c22c00698d68dd820a809f5d92f10ac0c13aef2a1d48c861406310108ee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\telDWAi9JINespV.exe
  .\telDWAi9JINespV.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\epklccaddnppcemlegjbcahkoigohcha\background.html

Filesize
146B

MD5
4e19e8722f6462d85fe5cd2c3852b81d

SHA1
34344ee3c8b49cf03da85f8b411d7173448689d0

SHA256
5d617b20f8121ae1569fe7627924436e9ecc999221d2cdc551064b869f79dfd8

SHA512
88641a531562c308e0c15d6fc8a9d17be079a0f781cc215acf180586e71afdc5e2c9fd7dc1f087fa6b315c567e1e64330e428bcd304d7097ff607a5ea97519fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\epklccaddnppcemlegjbcahkoigohcha\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\epklccaddnppcemlegjbcahkoigohcha\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\epklccaddnppcemlegjbcahkoigohcha\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\epklccaddnppcemlegjbcahkoigohcha\nm8PA2tZA.js

Filesize
6KB

MD5
3b78f6a865cd4d8055522ee18d75f920

SHA1
1c051feb096e5ffe73a0d4edf077c97b3dfede5d

SHA256
9489d5de22a7a3d0abf76cddb7f42bddd7d3f73f09277299135294324ebc9757

SHA512
574d7c66c1c691ae252f11531a216c6ec29f17eab628bcbe4e26a004612be69912ffe6f089beab4b654b702169892307a9a14a04c335c871ed617cc46b14eb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
ddb99233056e205c65633666bbeed452

SHA1
7e96983771036a3a95b7aaaff9f73c811664d2a4

SHA256
88f296466ad0f12c1140a2390bb3d1e5b219025b502b315a0e8294da2ff11ae2

SHA512
c48f0826e44f379a577828951dc42e123173dc1e8c970b15c8172b0dbae8f83c7755162b95263a6f13a0353a8ed9618a1b510a151048d16e86941608b6ed13b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
e018f21b057fce688175a9c69857f243

SHA1
22c1646f4b947a961eed01321a16a6db26045af0

SHA256
b161975e3b1899067abfc01c3794a635ff4ee99b0d52181bb82cdc5d517845d8

SHA512
5a0e6129804e9989f99e1b3f59714368063d301117fe4b5ae4ce0da0eadc2f1967cd2a9e4100553bcf5905262debfb519936ff2080430b11c518d478d9fc2fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\[email protected]\install.rdf

Filesize
598B

MD5
3cfc0a97229910047f269b649af59cfb

SHA1
23612a8d4e93fc78620851a96bf8a23250edec81

SHA256
a6d78a7c5f73bcb35fc73235907eb57027fbd19e1edbfe17479c235fadf86e69

SHA512
7ca0e8bd444fa5eb876ad9b63bcbc6fb680eeb850e98c25912dbc7059684a0fa4135e5f357f30377f5f550d6823bea77ed2e36c0887437b83ad1750b331f5857

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\telDWAi9JINespV.dat

Filesize
1KB

MD5
d9e02f8336093262663a1d1d1535a24f

SHA1
894ee993983708f7972617bc52935ec401a951b3

SHA256
3d4514917ae9b2b8ac4633f4181ade5b206f41a30ba2ec462cfc955c996bb643

SHA512
c6e7f1f025c98fe65e9ca92bb5f45ade2a1c34e176bc1fdad7d3efdac0b8f01ad1230db33d2bf67338c4b1489dbac4f855aa927c7e4808992cef84172e15d300

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\telDWAi9JINespV.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\telDWAi9JINespV.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/1096-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download