3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe
Size

785KB
MD5

98903075e93f4acff93c4fc55c9a4dde
SHA1

f1c03c6127e34cc76ac0650e22cdee8c3a781078
SHA256

3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f
SHA512

d387641e8637cc5677b0c9ea7ae096b23c464cfe17d984ed0e3150ff34ca8ac96fd63714d84cef679757c9798fa8c9a615d6160368a47c95da2874d4a6b5701f
SSDEEP

12288:h1OgLdaOUFF1Pjzs3n1CJ7EM4KIc8YFW3vegGzMyyD0rcXPaOGn:h1OYdaOKjfen1Y6KIc8dPW

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1388	7wFfZ9GvcAxR2kp.exe

Loads dropped DLL 1 IoCs

pid	Process
1048	3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dedcmlialcnhoffmimdhalihmiggldog\2.0\manifest.json	7wFfZ9GvcAxR2kp.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dedcmlialcnhoffmimdhalihmiggldog\2.0\manifest.json	7wFfZ9GvcAxR2kp.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dedcmlialcnhoffmimdhalihmiggldog\2.0\manifest.json	7wFfZ9GvcAxR2kp.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	7wFfZ9GvcAxR2kp.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	7wFfZ9GvcAxR2kp.exe
File opened for modification	C:\Windows\System32\GroupPolicy	7wFfZ9GvcAxR2kp.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	7wFfZ9GvcAxR2kp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1388	7wFfZ9GvcAxR2kp.exe
1388	7wFfZ9GvcAxR2kp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1388	1048	3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe	27
PID 1048 wrote to memory of 1388	1048	3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe	27
PID 1048 wrote to memory of 1388	1048	3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe	27
PID 1048 wrote to memory of 1388	1048	3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe	27

C:\Users\Admin\AppData\Local\Temp\3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe
"C:\Users\Admin\AppData\Local\Temp\3c9dc0998d2161e2a2cacfffee4b8c7aea91f647060e10c6d685fd20eaa2948f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\7wFfZ9GvcAxR2kp.exe
  .\7wFfZ9GvcAxR2kp.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\7wFfZ9GvcAxR2kp.dat

Filesize
1KB

MD5
d2f6954cb67f784d3af75b26704c02d9

SHA1
5fcc990bdd518446781c278805d70e7f064f2bcc

SHA256
ecec752ac8b707f8e635bf428c74f1bd922101bdafd52e532545df30c6870f35

SHA512
438b46f90d36ae1a8c115b37012e98343b918a96645368f47208f09bceb1b0b8af45858d44a94815a134cbfc88ea0829aabeef5dbe566d0c10bdc0a364f2a162

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\7wFfZ9GvcAxR2kp.exe

Filesize
625KB

MD5
ca04c0f764aa0797cbe40913d3d8d17f

SHA1
7358d68ace7d7e6213726433c41dd7b781762d74

SHA256
a018bdb7e28a4e0dd07da454e8192045f5994c66f95c47defaa0ce40661fc90f

SHA512
fae69fd13b4b9308973ff713fe7c6ee10525b76e9c70106dbe08673d86b6ecc3ebf5d90f6c3a461d64352726de28fbb5903c89db28916423766810c62686f0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\dedcmlialcnhoffmimdhalihmiggldog\Aval.js

Filesize
6KB

MD5
bb0916e2b85a551a614daab9098ebb00

SHA1
af2412b74112e17dd13ab06840280eeac8532cae

SHA256
484ec9fa1345302da1b0221e1f98e9610985a3d5c6dabef8dff061ae3b001954

SHA512
ec0df81b85c87e33ecf096ff4200903c80533a4fb6eb74c8718950bab4fb64311805982820e323e2b51c0b65efe87fdf1f03c32c66dcb457ff7e60c4cbb9839f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\dedcmlialcnhoffmimdhalihmiggldog\background.html

Filesize
141B

MD5
d7a860a300779e8d6ffc1605e90ee1c6

SHA1
ab7e63c223047709a4077261201211d2680d1714

SHA256
94faad0dff06bba0e9acf1e635f10cc41d5f3ac0c08ecdc012405717bb2051d5

SHA512
00829c18d69358e49804f5b22166396311c7515b22e16b3d51d57063eef64db9d5da0cc7a2b545ec3878a78581a108d154f55d5b3390967b43622b72876e47e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\dedcmlialcnhoffmimdhalihmiggldog\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\dedcmlialcnhoffmimdhalihmiggldog\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\dedcmlialcnhoffmimdhalihmiggldog\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
632ad133489bbd439e998b1a0e32d36e

SHA1
9d844953fca7a8a6cb6290127df28338916e522a

SHA256
911f417edccbb87171aa0a5e0dad825172d79688eb74ac125c7c324f89e3ddd1

SHA512
c1bf59c9369f322034c7ea4c350edb5b13d86fb210c243c286a4b2259dc0ef26347646ee6cc3052c5d8044c048d4a42b19e015475eda43e0bd6a5a3fe453651c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
293a840617df0462b50aeb110074e0cc

SHA1
28bc80645c847a97a40d43174735484171f5c1af

SHA256
143afc873c47e067cd1ce071e920f3709c62b4ad0f6e86c75e98f1415500cc82

SHA512
b27d0b7a2671bc1478b80adec38d6656ccd21000fe19c0fc1a05974e2acb35440b9ea692db7eaa2e7bbd5256ab19c279b5692b02456b6bb697b3bf25c0f4a04b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\[email protected]\install.rdf

Filesize
595B

MD5
e75c4f039182abba1aa29aaa798a7cd3

SHA1
c5b17990fa477a58806e7a229143131324621a0c

SHA256
15c7b09bcf2c4a67714a8de0766b11c8b2cce9b04bdaa5edfaf463481e996470

SHA512
2ab4a8434d3ddcae1d864024b24055a600431af1c940e1c962ea428e794a7dade9fce851a7521132a61568a6dc8591f595fe36acd737d53319b3731793d099fa

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\7wFfZ9GvcAxR2kp.exe

Filesize
625KB

MD5
ca04c0f764aa0797cbe40913d3d8d17f

SHA1
7358d68ace7d7e6213726433c41dd7b781762d74

SHA256
a018bdb7e28a4e0dd07da454e8192045f5994c66f95c47defaa0ce40661fc90f

SHA512
fae69fd13b4b9308973ff713fe7c6ee10525b76e9c70106dbe08673d86b6ecc3ebf5d90f6c3a461d64352726de28fbb5903c89db28916423766810c62686f0c0

Download Submit
memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x0000000000000000-mapping.dmp

Download