0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b

Analysis

max time kernel
40s
max time network
55s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe
Size

931KB
MD5

848908ded889afe5c78bf63ce1a32831
SHA1

b769ecfc5205759290131c059f6e8f6df65e87ca
SHA256

0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b
SHA512

223c4a68f8a1d5769b9be909362b018e2b3b76f1ef5697c7b1913e348e991e22f7d73a70f9efb6288ad31c1c24f0f31548c82da4c4592cf7349701488e6e4fce
SSDEEP

24576:h1OYdaOjMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfF:h1OsBMWyUQ+GUVFIcHPvpfF

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	evgGpYVpuDyePmi.exe

Loads dropped DLL 1 IoCs

pid	Process
1764	0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kieigegfbehecilainngcccodhffcmmp\2.0\manifest.json	evgGpYVpuDyePmi.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kieigegfbehecilainngcccodhffcmmp\2.0\manifest.json	evgGpYVpuDyePmi.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kieigegfbehecilainngcccodhffcmmp\2.0\manifest.json	evgGpYVpuDyePmi.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	evgGpYVpuDyePmi.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	evgGpYVpuDyePmi.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	evgGpYVpuDyePmi.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	evgGpYVpuDyePmi.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe
1924	evgGpYVpuDyePmi.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	evgGpYVpuDyePmi.exe
Token: SeDebugPrivilege	1924	evgGpYVpuDyePmi.exe
Token: SeDebugPrivilege	1924	evgGpYVpuDyePmi.exe
Token: SeDebugPrivilege	1924	evgGpYVpuDyePmi.exe
Token: SeDebugPrivilege	1924	evgGpYVpuDyePmi.exe
Token: SeDebugPrivilege	1924	evgGpYVpuDyePmi.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1924	1764	0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe	28
PID 1764 wrote to memory of 1924	1764	0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe	28
PID 1764 wrote to memory of 1924	1764	0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe	28
PID 1764 wrote to memory of 1924	1764	0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe	28

C:\Users\Admin\AppData\Local\Temp\0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe
"C:\Users\Admin\AppData\Local\Temp\0e8c16b406bcdbf7038704fd97e1c7ea804d926b348f61b5a4eeb9ebb3fbba2b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\evgGpYVpuDyePmi.exe
  .\evgGpYVpuDyePmi.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\evgGpYVpuDyePmi.dat

Filesize
1KB

MD5
004c4e0d7f3d183b4a08d5dbd6032a28

SHA1
23ec54de4542523e99f3258499f3f7fa73c87f37

SHA256
8e32e5512831b3d06df09c11e2adb89f828ae1877ab338a0d7c76a3a20978be4

SHA512
c0b5dc1d6e1588f763bf9c712bc98401cbc81f5ee66c4cab26bd355423b4111f9d07d8108cec17965a757b39d7b2bc3948f384693b6acf8ab173296b03214800

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\evgGpYVpuDyePmi.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\kieigegfbehecilainngcccodhffcmmp\background.html

Filesize
146B

MD5
b2bca3aab72bac061bc9227480e6dc60

SHA1
e0e1a975fe521226157bbaff06f72bdca4220160

SHA256
3b4fd68202db1d86b28cd7fb009723a8a9aa27630a0c9f84681aede5310697c4

SHA512
2ae059f98b7c99a22dc698c99f289908a47b793564077777a47c322c9466c14a9c2f1f871a53a37bcb531ce9766962d51938598939bf253d979f228572c20ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\kieigegfbehecilainngcccodhffcmmp\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\kieigegfbehecilainngcccodhffcmmp\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\kieigegfbehecilainngcccodhffcmmp\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\kieigegfbehecilainngcccodhffcmmp\rxXPy4uIj.js

Filesize
6KB

MD5
3b562df5693c8f8e0432e0f18f542bfe

SHA1
c2e99ccae2570a757f6360a0176c9612a980615a

SHA256
4181c19f33d28a711a514be4ea1fad1d2b773be2e845e4aac895d37dda6ff23d

SHA512
ddd3d09973ab9ae6b1429959d57908db3decc4e0969fe0389c3abd426bd7a3ea70a8cf530426b2d21e672895df11a621cd722555ff61f2f5d30769c6daf993b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
74dc2803f8aef9f1a7156842e992c467

SHA1
d969f5c31534c5580af867e6b3b427900e2ee03e

SHA256
086a43c07a7a8878e73e20732ec15ca236c32b83bed9d83d13a2216e2f928f52

SHA512
61387f782c9136a2066b5b356e3dc528c550e7126d62b9cdfe63e9d3b6bad8dc251ac96e719298f2ef346596877df9bb52dac460adb8155f98eb4f8a053b1df4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
8d3c7958e83c71cc12f8dc20ead826e4

SHA1
b128bf66e94eb2f19420c75a71ceef59fae65fcb

SHA256
c40331294f1f34ff2baa1c1b4521058dbc9045ba9b4e70fdff824ae62287a535

SHA512
0f7ece4485ccbe83df7ce9319c37622f371125bcc617b810a7215956ae5590ce1a12e9226917be160e2fe71cbdb7d0efc6b5c183e1edabc1c19f69c66ac23458

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\[email protected]\install.rdf

Filesize
597B

MD5
44aecc2b3f7bafdd3e6a484cfafce679

SHA1
25d21cc813d7eaba1e42f2c410ba4257d731641d

SHA256
af3de39db4d48572a8d19f8336b8f403069edd6af1764495db7237819dc865ad

SHA512
81dd1eeadf79016e8c5e64db89a0b325badb4b48cbe41a16145758c3a8c9764c31f4fec1f98460a74a6dc8725c49a6cd55dd8d0ae355bf3181a6a4609d80a815

Download Submit
\Users\Admin\AppData\Local\Temp\7zSB26F.tmp\evgGpYVpuDyePmi.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/1764-54-0x0000000074E01000-0x0000000074E03000-memory.dmp

Filesize
8KB

Download