Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 08:23
Static task
static1
Behavioral task
behavioral1
Sample
31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe
Resource
win7-20220812-en
General
-
Target
31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe
-
Size
931KB
-
MD5
232b4b1526f9b064f342ae57855b4311
-
SHA1
60cfb80db6e6a19030880a4a3a6571af16129732
-
SHA256
31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b
-
SHA512
3d77ea49ec6b1499e7f27a3f628f6dd1a4efa410f7949b8d53d4f17d69154e91565d06eb556d6752f093253354f39877f7ad39d375dd3c42baa41fd0e5d084c7
-
SSDEEP
24576:h1OYdaOgMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfw:h1OsyMWyUQ+GUVFIcHPvpfw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
J0vBKJUDgOGccw0.exepid process 1848 J0vBKJUDgOGccw0.exe -
Loads dropped DLL 1 IoCs
Processes:
31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exepid process 1088 31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
J0vBKJUDgOGccw0.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabodcnkcheoaejpkodhbhgcjknapcil\2.0\manifest.json J0vBKJUDgOGccw0.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabodcnkcheoaejpkodhbhgcjknapcil\2.0\manifest.json J0vBKJUDgOGccw0.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabodcnkcheoaejpkodhbhgcjknapcil\2.0\manifest.json J0vBKJUDgOGccw0.exe -
Drops file in System32 directory 4 IoCs
Processes:
J0vBKJUDgOGccw0.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol J0vBKJUDgOGccw0.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI J0vBKJUDgOGccw0.exe File opened for modification C:\Windows\System32\GroupPolicy J0vBKJUDgOGccw0.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini J0vBKJUDgOGccw0.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
J0vBKJUDgOGccw0.exepid process 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe 1848 J0vBKJUDgOGccw0.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
J0vBKJUDgOGccw0.exedescription pid process Token: SeDebugPrivilege 1848 J0vBKJUDgOGccw0.exe Token: SeDebugPrivilege 1848 J0vBKJUDgOGccw0.exe Token: SeDebugPrivilege 1848 J0vBKJUDgOGccw0.exe Token: SeDebugPrivilege 1848 J0vBKJUDgOGccw0.exe Token: SeDebugPrivilege 1848 J0vBKJUDgOGccw0.exe Token: SeDebugPrivilege 1848 J0vBKJUDgOGccw0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exedescription pid process target process PID 1088 wrote to memory of 1848 1088 31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe J0vBKJUDgOGccw0.exe PID 1088 wrote to memory of 1848 1088 31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe J0vBKJUDgOGccw0.exe PID 1088 wrote to memory of 1848 1088 31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe J0vBKJUDgOGccw0.exe PID 1088 wrote to memory of 1848 1088 31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe J0vBKJUDgOGccw0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe"C:\Users\Admin\AppData\Local\Temp\31016e29b291148919cdcb5907236684d609f8aa0f16d108f2b1ef90c94fa14b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\J0vBKJUDgOGccw0.exe.\J0vBKJUDgOGccw0.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\J0vBKJUDgOGccw0.datFilesize
1KB
MD54d8e0a823794a2fee99bc037ce1f27cd
SHA11a95b656edcc820fb9346dae6013e0374431e202
SHA25634acba92fdb0e98d613b8eee6bebb619424663a3dff30f1b153c01b6db116adf
SHA5124a05f9cffb19751c19cc87200dfbfd336aab6a938f570bfcc9fcbdbf12a723008e7422536baf6055511b7a9dddfb1e7232db30bc2228b5f9d3918e15b71a2bba
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\J0vBKJUDgOGccw0.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\kabodcnkcheoaejpkodhbhgcjknapcil\C.jsFilesize
6KB
MD5de1fe58b2c37fd74264d0f793bcc1d1e
SHA13162e72b23c5f0699b94d9e7783a5e635cb61abe
SHA256dd75820e5162e82ef68d2b8dac6f3c9b03211202d336ee1ce5c2472a1e214e83
SHA512d096ddb9554937ec31071cf8a6135c8b9cac65d3aab557eb75270ec71f471e44e8d3fdb20fc432420e71673d720be5c3bb38c1bc85a66e0caa7351c865c8e71a
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\kabodcnkcheoaejpkodhbhgcjknapcil\background.htmlFilesize
138B
MD5b62b7a3fa9b36d2048feab0d0c3c4f6a
SHA161e5e247b7d198da06bae3c50ccb50417f8c885c
SHA256f7809d7eec5c7c6b710a51170a9ebc38e3b75b010e3b6b3a425598507107da1f
SHA5121bdbef31b51176c8a96408e8bfad9ca48f64f0bdc321de3c0ee0c3172f0c4d3cef3de6897d1e3a8bc301281c395b362b09b58c9e38ac76fe6533cae2529d989a
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\kabodcnkcheoaejpkodhbhgcjknapcil\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\kabodcnkcheoaejpkodhbhgcjknapcil\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\kabodcnkcheoaejpkodhbhgcjknapcil\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\[email protected]\chrome.manifestFilesize
35B
MD5b21556fe07d862fa5103c611b8b3548e
SHA1c3db28f702302617002eb6e30c674365fe6a1627
SHA2566df23702e7cfd1b425304811ab175c39cf8332da1189d70b9b9a2065f79db852
SHA5122d0c75da42fcee9a227d0190db6cdeb8f937a383177651515d1d6a10e3a065eb015d24e1afe4b34d7751ab44ce02921e597d84f3e5321f80aea844b73f3131f9
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\[email protected]\content\bg.jsFilesize
8KB
MD59d9bd9a9ccde934e44bd99c304b434c3
SHA173f29bc5b671538b690d4247fde93eba50f08f4a
SHA256c0117e1ed5f941499e178e53feeb5b66ab537ad8cbd8ddf01177427a8f1ea048
SHA512b25144e6bec2ab4ad136917441264406ab3895119ce82be900b819660537a38e46a9eb3d7f31295123c4e0cad8115b3dbba432209e927bc96316189e252dff86
-
C:\Users\Admin\AppData\Local\Temp\7zS31D.tmp\[email protected]\install.rdfFilesize
591B
MD5968bf9b925c0326255ae660b1478f5c0
SHA144e73b31445d68f576710c2a31dd803a7b2c09f7
SHA256a6149209c62101b2b25b5d7a05be3e44299425685040ece2c7d61ce566a6f87f
SHA51202214a16fe5b18881447be21793a330803dc3481a05bf39871c3c70e123b9ae89d3c73a085594da69ce7c3095a4fa83534c4462be1f8ff7b7e6690c3d5ffccb2
-
\Users\Admin\AppData\Local\Temp\7zS31D.tmp\J0vBKJUDgOGccw0.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
memory/1088-54-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/1848-56-0x0000000000000000-mapping.dmp