d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe
Size

931KB
MD5

f36aecc56afd19b0eaee29fb9a72ba13
SHA1

8ef39489abe4072a676f0fb7f00ff5b075189bdc
SHA256

d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c
SHA512

855733a9e18146585fabdfcf8e5b8025aa3655b0d7f4b85b4483fc7c6e358e519be9e185543e43b95faeae2eef52b72a70ba3bb929736cd8dd2f4ce908bd298f
SSDEEP

24576:h1OYdaOSMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpf1:h1OsgMWyUQ+GUVFIcHPvpf1

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

BhDC2aRwu7Id25E.exe

pid process

1364 BhDC2aRwu7Id25E.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

BhDC2aRwu7Id25E.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlnheepbbijmepnbnpkddcfjogdfdchj\2.0\manifest.json	BhDC2aRwu7Id25E.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlnheepbbijmepnbnpkddcfjogdfdchj\2.0\manifest.json	BhDC2aRwu7Id25E.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlnheepbbijmepnbnpkddcfjogdfdchj\2.0\manifest.json	BhDC2aRwu7Id25E.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlnheepbbijmepnbnpkddcfjogdfdchj\2.0\manifest.json	BhDC2aRwu7Id25E.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlnheepbbijmepnbnpkddcfjogdfdchj\2.0\manifest.json	BhDC2aRwu7Id25E.exe

Drops file in System32 directory 4 IoCs

Processes:

BhDC2aRwu7Id25E.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	BhDC2aRwu7Id25E.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	BhDC2aRwu7Id25E.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	BhDC2aRwu7Id25E.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	BhDC2aRwu7Id25E.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

BhDC2aRwu7Id25E.exe

pid	process
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe
1364	BhDC2aRwu7Id25E.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

BhDC2aRwu7Id25E.exe

description	pid	process
Token: SeDebugPrivilege	1364	BhDC2aRwu7Id25E.exe
Token: SeDebugPrivilege	1364	BhDC2aRwu7Id25E.exe
Token: SeDebugPrivilege	1364	BhDC2aRwu7Id25E.exe
Token: SeDebugPrivilege	1364	BhDC2aRwu7Id25E.exe
Token: SeDebugPrivilege	1364	BhDC2aRwu7Id25E.exe
Token: SeDebugPrivilege	1364	BhDC2aRwu7Id25E.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe

description	pid	process	target process
PID 3992 wrote to memory of 1364	3992	d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe	BhDC2aRwu7Id25E.exe
PID 3992 wrote to memory of 1364	3992	d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe	BhDC2aRwu7Id25E.exe
PID 3992 wrote to memory of 1364	3992	d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe	BhDC2aRwu7Id25E.exe

C:\Users\Admin\AppData\Local\Temp\d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe
"C:\Users\Admin\AppData\Local\Temp\d188541387d4d39836bf4181d7cabba8264d21649773b098d11386aeb0573e0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\BhDC2aRwu7Id25E.exe
.\BhDC2aRwu7Id25E.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
747dc22087252783c007abe0d45f2d18

SHA1
cbf89f3e7ae8dbdd5e7e40cd029839768358d067

SHA256
253cf97bccc93960f23914e33ea814606a175094eae141daf250b679dd123220

SHA512
09625d52ab6e57f3cd69160054f825b1f1cdad3538f2c6a0aafbea0d4114d86c03aa26b0e3bd2cecbf6b44e89f93ffebc431dd1a852fe5649fdf3f5720ed73a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
fce0aff7d969797962145197131b1990

SHA1
95ab3596fc4b6aeb5233fc4577ac8fb74e733d4e

SHA256
b7b4716ea08c27665aad8ed4d354b39ce50a76cb8c3bd89dbcfcab08ef01d0ec

SHA512
11ec24ba199e18604c152182d995e18d184e07f6d963dc7dfb84345fd91075371771609109a0ff72ac9ce267b9dad94cbe290d33d8e9d28caaef9f7cb32e0f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\[email protected]\install.rdf
Filesize
594B

MD5
899aed0a48328ca24c50c3c4fb570f22

SHA1
62c7f9f65809c7266865948bdb6bd1f771ddbaa5

SHA256
482b60bcf0f363b13265f1d153469cd63002a61d3fc146b0dfeadcf49063b95e

SHA512
a1031d1a722c1edf7d06cc1fd4bcaf21464bb5dd5dbddc4effa933630cc7444977842d85e2fc523e7c5a07be7aa63fa5b99e50470d525f96daeb70f5fd160c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\BhDC2aRwu7Id25E.dat
Filesize
1KB

MD5
fad54c76419e1a0fc0bff62eabf57070

SHA1
d7c8ba023f5c58f6ce8e738b90239be9d26e0a74

SHA256
b7d5e2186e54514ed7d05873e96a356ae76b88074e3c5f129d2787d1218269bd

SHA512
5261e9bdbc5dc1341c5a2bab9df19b7bc6e39233831a8848166df5d8834b6193817c641b124c12bc2d7b559a03b65ef5c855bbfe92fa3c9d747048d24c597546

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\BhDC2aRwu7Id25E.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\BhDC2aRwu7Id25E.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\mlnheepbbijmepnbnpkddcfjogdfdchj\H.js
Filesize
6KB

MD5
5bb7dbe160aa24045e606b13effeda97

SHA1
0a29da25c2d8dc7d067b82acdd8c050908750f1d

SHA256
2188ccdf00393f8c8bf9b50c598e4da1628789d2149cf2cf45c77373469a654e

SHA512
7d1632819f136fe78b8a4e0563a1a768e98552b8569ae3c27de901b5704370339f28da9ac0fac16fdf4d36701f50e7088e2d368229e36e766fa9bd7f8165f1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\mlnheepbbijmepnbnpkddcfjogdfdchj\background.html
Filesize
138B

MD5
6f78a9f8b3159b436ed441ca0fa88fb7

SHA1
78b91858aceb4c4b345970b7f5375bd9c5cee5e7

SHA256
df00d7c896f5836452fe07dd66a17dd46157fdec21d3c8ca886b1a7ba909165e

SHA512
f867296bae6366e6328c8bead204c16130aad48e3c8770a99bf994eb85e7d31c748ed6d219c5bbcc8b2619c0721396213dfe82e4c0072938f6135ca91d627d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\mlnheepbbijmepnbnpkddcfjogdfdchj\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\mlnheepbbijmepnbnpkddcfjogdfdchj\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8FB2.tmp\mlnheepbbijmepnbnpkddcfjogdfdchj\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1364-132-0x0000000000000000-mapping.dmp

Download