b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe
Size

924KB
MD5

3c2c1e827afa7147757cef3d35c18fa2
SHA1

2e36f94053192adb0c37a7886a6597c6380be114
SHA256

b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a
SHA512

f0f5a0ddad54f1cc7cba68d9dadccc7d3d50f3cc82d054e79d06de2b40971b5051fb31cf54cca70e936d6c96d1d06a7121595057a647991c38f02e61cffb66c5
SSDEEP

24576:h1OYdaO0fC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXN:h1OstMN6wdBh5N5Z4E8PuXN

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

1d7Q4qxnyPLjzUG.exe

pid process

4756 1d7Q4qxnyPLjzUG.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

1d7Q4qxnyPLjzUG.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\imjmfmbcmcnfdkgbhglionngepfgjdll\2.0\manifest.json	1d7Q4qxnyPLjzUG.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\imjmfmbcmcnfdkgbhglionngepfgjdll\2.0\manifest.json	1d7Q4qxnyPLjzUG.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\imjmfmbcmcnfdkgbhglionngepfgjdll\2.0\manifest.json	1d7Q4qxnyPLjzUG.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\imjmfmbcmcnfdkgbhglionngepfgjdll\2.0\manifest.json	1d7Q4qxnyPLjzUG.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\imjmfmbcmcnfdkgbhglionngepfgjdll\2.0\manifest.json	1d7Q4qxnyPLjzUG.exe

Drops file in System32 directory 4 IoCs

Processes:

1d7Q4qxnyPLjzUG.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1d7Q4qxnyPLjzUG.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1d7Q4qxnyPLjzUG.exe
File opened for modification	C:\Windows\System32\GroupPolicy	1d7Q4qxnyPLjzUG.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1d7Q4qxnyPLjzUG.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

1d7Q4qxnyPLjzUG.exe

pid	process
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe
4756	1d7Q4qxnyPLjzUG.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

1d7Q4qxnyPLjzUG.exe

description	pid	process
Token: SeDebugPrivilege	4756	1d7Q4qxnyPLjzUG.exe
Token: SeDebugPrivilege	4756	1d7Q4qxnyPLjzUG.exe
Token: SeDebugPrivilege	4756	1d7Q4qxnyPLjzUG.exe
Token: SeDebugPrivilege	4756	1d7Q4qxnyPLjzUG.exe
Token: SeDebugPrivilege	4756	1d7Q4qxnyPLjzUG.exe
Token: SeDebugPrivilege	4756	1d7Q4qxnyPLjzUG.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe

description	pid	process	target process
PID 4648 wrote to memory of 4756	4648	b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe	1d7Q4qxnyPLjzUG.exe
PID 4648 wrote to memory of 4756	4648	b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe	1d7Q4qxnyPLjzUG.exe
PID 4648 wrote to memory of 4756	4648	b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe	1d7Q4qxnyPLjzUG.exe

C:\Users\Admin\AppData\Local\Temp\b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe
"C:\Users\Admin\AppData\Local\Temp\b3f047366b1dd12c8ea3c39e67123be5b54e6dc481369a2f2f225f5d22b53f0a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\1d7Q4qxnyPLjzUG.exe
.\1d7Q4qxnyPLjzUG.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\1d7Q4qxnyPLjzUG.dat

Filesize
1KB

MD5
528444d15d684b42648f31191aadbb11

SHA1
22b3a658be6ac37f628996051dfbdaae65717e36

SHA256
e4abbc203e96afb567a7e1129f4a31796173b16bbb0297f7319bc84b0ebd8719

SHA512
760fb9ac8914c7e635a2505a9eb4cfc1e1d7fc13aadf49a6af0fd97191d91e8d795dbc094dd021ebb4c7ed9cd8f24ca69f7ce9fef41188a9c070bd0bae392919

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\1d7Q4qxnyPLjzUG.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\1d7Q4qxnyPLjzUG.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
6a6fd5fd6c47b0de261ab0312ef9f7ba

SHA1
9e0c22ff8577025a3175506ebe714c210ea3b7ce

SHA256
5a14028fb6ea7460b592d7a06a8a9258ce45b9e3a320ac934b46cd72c6953311

SHA512
44c5e4f84e6b25cddc6b4635a5bb6c56c72778c27b355d8cb8df3d4f1e1c39dbffdc2bce0669c6a3e86531443f80b8bfbc488d7495f3540c8f3a264fb5135f33

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
6064966e455f038c58c0bccfdab92ec9

SHA1
1da7ad0e61f062c33b281aebbb2c2ca87fa04fa6

SHA256
3a4eb06c7a8b8dfc374a6e4af4d7b5038f4a679dd5c6777e25a173dd7d8bb369

SHA512
dcf346ec148b8dcaf4036089274ef8f7861e628539537e9dd02f9e3bb2e14bb14f39999028d719a86d80936c51c98820318ca601114015233d2341e830a7caf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\[email protected]\install.rdf

Filesize
594B

MD5
38626b60d32d14a426153b2ffdb61189

SHA1
cade85aeb25dbb65264032e6e382619828b3743a

SHA256
2871b6ccf2c6b103221ef0101724b39454e6ac9feeb3a324def1693945af49c4

SHA512
da245cf4c6a324d5c3b63539224329ce3a85686c3dbbe2a3ad17bbdc72bfa1beadc772a5829f1ca537e009a08177171d8277caf8e6f3464ad81f7ef19e95ee64

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\imjmfmbcmcnfdkgbhglionngepfgjdll\ZH6.js

Filesize
6KB

MD5
c57c203b334bb79f48c5b77397f7a61d

SHA1
452b3365b881aac3ae608d2bafcb06251df032b2

SHA256
3d0c4f8d828bc3fa60de6f86f49719fc2550b6df1fb5001949793402f0af49f4

SHA512
2b605c309553c44d73e3c08bb2eb608939c778976802fcee0d4490bcc74dedadafb7a3d16b605655058bdb8eeb278980c8bf8aa0c17253900b5cdfd9d22ac6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\imjmfmbcmcnfdkgbhglionngepfgjdll\background.html

Filesize
140B

MD5
b0fb0d396d0be8e33b7e7ed020286028

SHA1
5ed9fed96be809e88f9462e34bbe05760f86ece2

SHA256
0fac90b4e786cd704b205261738dc8c29066c44afbf11dc3362eece1aefaef3d

SHA512
09191ff313af008dd89ff9b57bb2ee52f064ad9f27a595c2d161fddaa691d741aca6cc3a8b87cc6fd6976814413d59ad2584cec7e960499480cf34ceede26dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\imjmfmbcmcnfdkgbhglionngepfgjdll\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\imjmfmbcmcnfdkgbhglionngepfgjdll\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FC6.tmp\imjmfmbcmcnfdkgbhglionngepfgjdll\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4756-132-0x0000000000000000-mapping.dmp

Download