e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f

Analysis

max time kernel
170s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe
Size

924KB
MD5

d7c0395084065f7227c894e967d9c07f
SHA1

27b2c87ad31560dec648f73cec7a97797e892e36
SHA256

e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f
SHA512

acb1acd5a610707234c8aed7063327ec32570891128ba09f7203a61680bc46dd7f7ac14706ce2d2719d59e630d7f87b6a4411778c07f6ddc5acd3f4e53c3af93
SSDEEP

24576:h1OYdaOMfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX4:h1OshMN6wdBh5N5Z4E8PuX4

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

3bLukLU2dHGfYfq.exe

pid process

4844 3bLukLU2dHGfYfq.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

3bLukLU2dHGfYfq.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihnlmljmmjeibichgekkfgioecobiem\2.0\manifest.json	3bLukLU2dHGfYfq.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihnlmljmmjeibichgekkfgioecobiem\2.0\manifest.json	3bLukLU2dHGfYfq.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihnlmljmmjeibichgekkfgioecobiem\2.0\manifest.json	3bLukLU2dHGfYfq.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihnlmljmmjeibichgekkfgioecobiem\2.0\manifest.json	3bLukLU2dHGfYfq.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihnlmljmmjeibichgekkfgioecobiem\2.0\manifest.json	3bLukLU2dHGfYfq.exe

Drops file in System32 directory 4 IoCs

Processes:

3bLukLU2dHGfYfq.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	3bLukLU2dHGfYfq.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	3bLukLU2dHGfYfq.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	3bLukLU2dHGfYfq.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	3bLukLU2dHGfYfq.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

3bLukLU2dHGfYfq.exe

pid	process
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe
4844	3bLukLU2dHGfYfq.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

3bLukLU2dHGfYfq.exe

description	pid	process
Token: SeDebugPrivilege	4844	3bLukLU2dHGfYfq.exe
Token: SeDebugPrivilege	4844	3bLukLU2dHGfYfq.exe
Token: SeDebugPrivilege	4844	3bLukLU2dHGfYfq.exe
Token: SeDebugPrivilege	4844	3bLukLU2dHGfYfq.exe
Token: SeDebugPrivilege	4844	3bLukLU2dHGfYfq.exe
Token: SeDebugPrivilege	4844	3bLukLU2dHGfYfq.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe

description	pid	process	target process
PID 1984 wrote to memory of 4844	1984	e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe	3bLukLU2dHGfYfq.exe
PID 1984 wrote to memory of 4844	1984	e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe	3bLukLU2dHGfYfq.exe
PID 1984 wrote to memory of 4844	1984	e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe	3bLukLU2dHGfYfq.exe

C:\Users\Admin\AppData\Local\Temp\e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe
"C:\Users\Admin\AppData\Local\Temp\e3e78fc50519eab0f4f61043ae811808e351b2d4f73099c134a2f4052704f83f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\3bLukLU2dHGfYfq.exe
.\3bLukLU2dHGfYfq.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\3bLukLU2dHGfYfq.dat
Filesize
1KB

MD5
984804113bd3da429780deda08992aa1

SHA1
840133c075951cb4e173ad9d0bd6e04c3028a77a

SHA256
b538a58b9a4e5845fe8db673462097ec46312ed171bbb66473e1415be3a4df7f

SHA512
ebd0da54695870e3268287cca116d6e0978e2e5c904bb86484430d3e8afb154986a973e8774880f4536adb1fa2b4bc3a72304ba188e8a83d403255e37b6d85aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\3bLukLU2dHGfYfq.exe
Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\3bLukLU2dHGfYfq.exe
Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
1f71e9e27ad47aa0dfcbd220f8c562f1

SHA1
8ab34e925774c8ca7fd6e5a43ef83a8d1ddc3c64

SHA256
7f60edc86af5fe58419ef799baf5e96213fd74dc68abca2d28a0351fb812ba35

SHA512
bd488f70bba2983af6cd02ced467cb8c3459166743c772cda4b730af7e32700dfaf43abe7a93beb8a92f6f333806422267a968b72877be2f624ae99c1183e006

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
113063395a90d7998ccd9a6ef3da4179

SHA1
817699275c18d1613ead503e1dc5d8090230892e

SHA256
b118e8012d80386dc105ee0077391034d955979df00e68e9ba1b9e4a24cf2a4a

SHA512
b47839ef2a3690edf40b5dbabb728541430ccffa9d92b942f5b08c557568c1371436388e6923d28321bca41398632fbc84551258472aef4af52d1220e4d7d87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\[email protected]\install.rdf
Filesize
592B

MD5
05308e8e573a6b8eceeef39f8b311a6a

SHA1
b58b6c98af050a6da40012f4852e9a621666f694

SHA256
23eedf9db821e89d1d10156816381937bfd6c5056734846759633356164c98bc

SHA512
63c84815e1b6df49e8ffd98d19c83e96cf92dda04780a0525d924cb52f506bf315c5047374a4a4dee2a7057b31b058694ae178078fbc075d0d7ba7734f7c1ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\eihnlmljmmjeibichgekkfgioecobiem\E3B3.js
Filesize
6KB

MD5
d6b0ef8e06ea554b4f0699c4100db83d

SHA1
e3e5c10d5bfa4b6ab236bc4e9057a37553570f52

SHA256
710fb0de9a95dd77c453c058c6f691eba1ba35874f562109cc5cb8be305c11b0

SHA512
87b4f6203a066c6a28eb59df38380450b1f866f952e5a61e367ecbac00839b6b188c7baa828c5eaf54944dfe67364a1f22fdda5d58defcb87c98f34868777d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\eihnlmljmmjeibichgekkfgioecobiem\background.html
Filesize
141B

MD5
fd842b810e52f7e2c79769e7962bcf3b

SHA1
b5bc789baff35b198859360f3838b06b71517b89

SHA256
0915c94a1ec8b8e7f9ceb1ad15dbae028a87b898c7879a894e80c6376165d399

SHA512
889edee4939404402a310c63f7cc1e914de65b349ebab6f2bf1286d82355e37b48e093c4c04e13585c07747ec7864cc84f4a2da7a5fb8e093733a301d87fed3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\eihnlmljmmjeibichgekkfgioecobiem\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\eihnlmljmmjeibichgekkfgioecobiem\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS18B8.tmp\eihnlmljmmjeibichgekkfgioecobiem\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4844-132-0x0000000000000000-mapping.dmp

Download