8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a

General

Target

8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
Size

1.1MB
MD5

e5c90586782654161d367a0b917f2c11
SHA1

6bd3a5befce8d8853e56689fe5379ad213774915
SHA256

8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a
SHA512

d416a6b80acbb9c610d96b57ff7142a5c4b8d4d750b25952718031118dc004e1c2b2c14fb62e887d855a173ad39b40681fce7f9c4fcd5f21124ae3277c67064a
SSDEEP

24576:iZuufNfHuZDIahRUJ8laSNovBq0fTQ+thff0lXh:iXf8hhraJLTztlmh

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ollcabooapofejebbdcphfhihgnofaed\2.0\manifest.json	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ollcabooapofejebbdcphfhihgnofaed\2.0\manifest.json	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ollcabooapofejebbdcphfhihgnofaed\2.0\manifest.json	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ollcabooapofejebbdcphfhihgnofaed\2.0\manifest.json	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ollcabooapofejebbdcphfhihgnofaed\2.0\manifest.json	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

Drops file in System32 directory 4 IoCs

Processes:

8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

pid	process
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

description	pid	process
Token: SeDebugPrivilege	2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
Token: SeDebugPrivilege	2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
Token: SeDebugPrivilege	2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
Token: SeDebugPrivilege	2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
Token: SeDebugPrivilege	2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
Token: SeDebugPrivilege	2820	8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe

C:\Users\Admin\AppData\Local\Temp\8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe
"C:\Users\Admin\AppData\Local\Temp\8890da59fa55d62e7f2af20ae300610c1525502a9ffe54a8e39802bf6fccd45a.exe"
1⤵
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-132-0x0000000002650000-0x0000000002717000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads