Analysis

  • max time kernel
    162s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 08:17

General

  • Target

    28541e8555355e57b121b318dda183748b91edd8bf29e4279d748ae5a57a8342.exe

  • Size

    931KB

  • MD5

    fab2aa7420fc6f6fb4747a8d6d6e2b58

  • SHA1

    e3dab6fa58a8a9443f87545dce3ae9d8f91fb07f

  • SHA256

    28541e8555355e57b121b318dda183748b91edd8bf29e4279d748ae5a57a8342

  • SHA512

    6651e308006fb94ba393cf11b591f082bad1b121c6bfabe0f26fb8bb2f61c1cda7c13db8525efc06ab62c2c735ba34575b3ecbc6b1f4e7db3e9ed893589fe8a4

  • SSDEEP

    24576:h1OYdaOWMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfJ:h1OsoMWyUQ+GUVFIcHPvpfJ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops Chrome extension 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28541e8555355e57b121b318dda183748b91edd8bf29e4279d748ae5a57a8342.exe
    "C:\Users\Admin\AppData\Local\Temp\28541e8555355e57b121b318dda183748b91edd8bf29e4279d748ae5a57a8342.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\KeVXTEVgOn5Posp.exe
      .\KeVXTEVgOn5Posp.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\KeVXTEVgOn5Posp.dat

    Filesize

    1KB

    MD5

    1aa725fc5444764cbe991d1f618938f4

    SHA1

    b93b466c433a3ff87006142dc8b64226a0f07eaa

    SHA256

    aa335af4a48a9e1f72dcf0a1af0c4dc06b6103c2b2a3c312698a4559722fea62

    SHA512

    5f22e66971687f1abf0d21f175818d63c7f15fe1ff144c9762ea56135fa78deddba46848cd85663e75e8121a83683efb2db4fa069e9f48243c47f309bf068e5d

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\KeVXTEVgOn5Posp.exe

    Filesize

    771KB

    MD5

    e8ef8ed232808bfa240b33b376bb74a8

    SHA1

    b7ebfbda42fb24594210d3f97921c5b33b88585d

    SHA256

    a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

    SHA512

    24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\KeVXTEVgOn5Posp.exe

    Filesize

    771KB

    MD5

    e8ef8ed232808bfa240b33b376bb74a8

    SHA1

    b7ebfbda42fb24594210d3f97921c5b33b88585d

    SHA256

    a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

    SHA512

    24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\gnjaifafdolhgdnlcckcinnjiipgpabl\X1aWLw2.js

    Filesize

    6KB

    MD5

    30353096a0d91b17608a92ad3565ad17

    SHA1

    0aa8e8da73d6e283fbb27cde1f6abe1a8fcb1bdd

    SHA256

    c1ce5a20948d535aabb1a0b4a147a18bd913c5c73449ce59767a917e73eafdf7

    SHA512

    80de8fd2d2dcac0cddbf658ce8e39353787fe9461a67e9652f17f65303761797b4fe0a1ffd96338264c5269aafe33a479f8fed10a50fed9d321cd4ce09b0be7b

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\gnjaifafdolhgdnlcckcinnjiipgpabl\background.html

    Filesize

    144B

    MD5

    9ed3bc63ce1d039811c353f0b2b9d90f

    SHA1

    119ec915be64aa17122c66f2103dcfc97300793c

    SHA256

    24e4f32e9e2f58c2b05f0c2d15d976c230fbe8da81cb23217f85bb746e6f83d8

    SHA512

    d7b376cd1808351839bdfc8c4914558df7920fed3a3dba87237f86396f84fb98098f1a700f9ef0915bc3fa8ad50859936b3c410082d5c5ef42c56852262ca47e

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\gnjaifafdolhgdnlcckcinnjiipgpabl\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\gnjaifafdolhgdnlcckcinnjiipgpabl\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSAF99.tmp\gnjaifafdolhgdnlcckcinnjiipgpabl\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • memory/2764-132-0x0000000000000000-mapping.dmp