Analysis
-
max time kernel
35s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 08:22
Static task
static1
Behavioral task
behavioral1
Sample
94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe
Resource
win10v2004-20221111-en
General
-
Target
94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe
-
Size
931KB
-
MD5
6519f6be4bd4ececa26245b16d2f6ec2
-
SHA1
4d7d280b0b80169ffd5a45086d8a5f21a72be7f3
-
SHA256
94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11
-
SHA512
ec824e5d8c52561d3655eaa0b3b68a3c8e04498375a91de575597aa4402850e8e518f656d4da07d9bb739934f145ee14294d320ce3c01ec44e2aa0572bb4ff2d
-
SSDEEP
24576:h1OYdaOoMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfS:h1OsOMWyUQ+GUVFIcHPvpfS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
1jpKz3XMg0szHPn.exepid process 888 1jpKz3XMg0szHPn.exe -
Loads dropped DLL 1 IoCs
Processes:
94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exepid process 936 94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
1jpKz3XMg0szHPn.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdjgimibdoeicgaabhdlfildgnggmpjf\2.0\manifest.json 1jpKz3XMg0szHPn.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdjgimibdoeicgaabhdlfildgnggmpjf\2.0\manifest.json 1jpKz3XMg0szHPn.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdjgimibdoeicgaabhdlfildgnggmpjf\2.0\manifest.json 1jpKz3XMg0szHPn.exe -
Drops file in System32 directory 4 IoCs
Processes:
1jpKz3XMg0szHPn.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 1jpKz3XMg0szHPn.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 1jpKz3XMg0szHPn.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 1jpKz3XMg0szHPn.exe File opened for modification C:\Windows\System32\GroupPolicy 1jpKz3XMg0szHPn.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
1jpKz3XMg0szHPn.exepid process 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe 888 1jpKz3XMg0szHPn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1jpKz3XMg0szHPn.exedescription pid process Token: SeDebugPrivilege 888 1jpKz3XMg0szHPn.exe Token: SeDebugPrivilege 888 1jpKz3XMg0szHPn.exe Token: SeDebugPrivilege 888 1jpKz3XMg0szHPn.exe Token: SeDebugPrivilege 888 1jpKz3XMg0szHPn.exe Token: SeDebugPrivilege 888 1jpKz3XMg0szHPn.exe Token: SeDebugPrivilege 888 1jpKz3XMg0szHPn.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exedescription pid process target process PID 936 wrote to memory of 888 936 94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe 1jpKz3XMg0szHPn.exe PID 936 wrote to memory of 888 936 94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe 1jpKz3XMg0szHPn.exe PID 936 wrote to memory of 888 936 94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe 1jpKz3XMg0szHPn.exe PID 936 wrote to memory of 888 936 94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe 1jpKz3XMg0szHPn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe"C:\Users\Admin\AppData\Local\Temp\94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\1jpKz3XMg0szHPn.exe.\1jpKz3XMg0szHPn.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\1jpKz3XMg0szHPn.datFilesize
1KB
MD58b525e470c469874a97015267379348c
SHA14be2f1dccbfd690d035ea04dae64f591c2ba2a7f
SHA256829bad62d707953edf39850ee069c525b5bc84461a6737e990d49eb4bc920e2c
SHA5127c34e72decd7a0456f8c4056dd5819763f2b10009200b6b89b7558efc3694eeba834becdaae7e65bcda5818a513bdf91754fbb28895e9870655456610a558a8c
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\1jpKz3XMg0szHPn.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\gdjgimibdoeicgaabhdlfildgnggmpjf\background.htmlFilesize
141B
MD5a5f3e184cc2466bb151ab49eefd0025e
SHA195aba9991ba213417a48c76bcf88c31b2bda6093
SHA2564f8225c5cadc734041c25d1c5bfe1b132f71f594badcc49bc453a466bb2ab81c
SHA51293205cd0e4e610aa79788a37910b4ba4c64aaf6c91a72b1ec0120f517eb8788e893dade86f4e125aa8f7824f7b4fcf738b1283d7dbd5550ce948482553ed4270
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\gdjgimibdoeicgaabhdlfildgnggmpjf\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\gdjgimibdoeicgaabhdlfildgnggmpjf\dgQo.jsFilesize
6KB
MD5e7095cbb6034e5bd64be2d52c0684893
SHA178156434e1eb08b91ffd8f9bb3f59dc3acaaea46
SHA25696931b3b220192eae8b83fa89c2757451648b3d96440902efb6564465d97b710
SHA51212c2999e76ac08383952f29c174dda446e38c3b27293e77dc1993bcf13898598dda8e0b78e73ce900af9aaf2fbf2c95f5d3cfec5b167dee3a45184810f6dcfd8
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\gdjgimibdoeicgaabhdlfildgnggmpjf\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\gdjgimibdoeicgaabhdlfildgnggmpjf\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\[email protected]\chrome.manifestFilesize
35B
MD528744bdc8def1d47a407318f532245be
SHA114e428e3d9d12baa95046c339b3d9fc54367375e
SHA2564acd9359e97b910492df1147d84c974b8f54d65c41ac83ee1e0e038195e8fe4e
SHA512d83071b8fda9cf48cc118693c1850b0c4fcd8982c91a21378902a965e25b317a974853ff62ebaf1aae7f09470caf2ee770fc67ddb0ffaece5bffa485cac7ff05
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5b43e674dbd711d39d790d3ca49f97074
SHA1fe957ed5ecf46e85d9270abf62b11f6e256aa538
SHA25647eed21d9ff9df64eac6130b80c2df038f55842c4953f1851b2cdb44b4c86f9f
SHA5127b2e97241ed23e0d8d7588a115cd1a324acefcfa0dbe12bfb6dbb82ccffe4e61f397fdfb24c0e1fbf3ae29c5f4cc65b257b1abc310f6baf11787947669a1c35e
-
C:\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\[email protected]\install.rdfFilesize
593B
MD521d68fdc3774c7e634f8f1ef9ff8d8ea
SHA1bc6ceef62ae50fcef905a3b304a59353d072e312
SHA2566b8ca5e03d98f44f0e5e832db988ec5387fc6452ca9ed70f94a8596c5022e259
SHA512e000dc3a7f845a03590a0e4529fa55babfab43cf3b332de60bb7a41d794df40c5e650ffb93667bf185f49b129b15a0ca0cfd11aafc91c9d0250d724b3421e889
-
\Users\Admin\AppData\Local\Temp\7zSAEF6.tmp\1jpKz3XMg0szHPn.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
memory/888-56-0x0000000000000000-mapping.dmp
-
memory/936-54-0x0000000075EC1000-0x0000000075EC3000-memory.dmpFilesize
8KB