b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe
Size

931KB
MD5

737923400bccf84afa77d1a88a076012
SHA1

bfd07326732e7d72c08eb9375002edf5848652d1
SHA256

b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10
SHA512

9bb07db4848020699190b857826a9fb5eeab32785e060f5b5794e102b049c2f827b423840f48060af1bd5049fc4db223240817f1567f20b8e510b6314a8878fe
SSDEEP

24576:h1OYdaO2MWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfC:h1OsQMWyUQ+GUVFIcHPvpfC

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

TamKpIF8Lazl6Cp.exe

pid process

2728 TamKpIF8Lazl6Cp.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

TamKpIF8Lazl6Cp.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcnmckgbmmoepmbjddlaoogmgcapifnf\2.0\manifest.json	TamKpIF8Lazl6Cp.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcnmckgbmmoepmbjddlaoogmgcapifnf\2.0\manifest.json	TamKpIF8Lazl6Cp.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcnmckgbmmoepmbjddlaoogmgcapifnf\2.0\manifest.json	TamKpIF8Lazl6Cp.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcnmckgbmmoepmbjddlaoogmgcapifnf\2.0\manifest.json	TamKpIF8Lazl6Cp.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcnmckgbmmoepmbjddlaoogmgcapifnf\2.0\manifest.json	TamKpIF8Lazl6Cp.exe

Drops file in System32 directory 4 IoCs

Processes:

TamKpIF8Lazl6Cp.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	TamKpIF8Lazl6Cp.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	TamKpIF8Lazl6Cp.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	TamKpIF8Lazl6Cp.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	TamKpIF8Lazl6Cp.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

TamKpIF8Lazl6Cp.exe

pid	process
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe
2728	TamKpIF8Lazl6Cp.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

TamKpIF8Lazl6Cp.exe

description	pid	process
Token: SeDebugPrivilege	2728	TamKpIF8Lazl6Cp.exe
Token: SeDebugPrivilege	2728	TamKpIF8Lazl6Cp.exe
Token: SeDebugPrivilege	2728	TamKpIF8Lazl6Cp.exe
Token: SeDebugPrivilege	2728	TamKpIF8Lazl6Cp.exe
Token: SeDebugPrivilege	2728	TamKpIF8Lazl6Cp.exe
Token: SeDebugPrivilege	2728	TamKpIF8Lazl6Cp.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe

description	pid	process	target process
PID 2280 wrote to memory of 2728	2280	b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe	TamKpIF8Lazl6Cp.exe
PID 2280 wrote to memory of 2728	2280	b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe	TamKpIF8Lazl6Cp.exe
PID 2280 wrote to memory of 2728	2280	b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe	TamKpIF8Lazl6Cp.exe

C:\Users\Admin\AppData\Local\Temp\b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe
"C:\Users\Admin\AppData\Local\Temp\b51531f8b423a5eb75b469619d019adef81f4d8b0ba23c001643a794991dfe10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\TamKpIF8Lazl6Cp.exe
.\TamKpIF8Lazl6Cp.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\TamKpIF8Lazl6Cp.dat

Filesize
1KB

MD5
beec8f52b3c39709d5b2d34630a4107b

SHA1
3a5d555e6bf957a8f0a1d2f5381b687889142912

SHA256
09f0f475e96e6c268ad2b7ae38c25c008f2645958e6c98cb2defe33cbff01877

SHA512
ca94bbb69299f57a8ff6c4ff40bec76b0e12f1ef801a9f2df6773f5b9a5d6c8677dd2694436213c5563fda26ff1deac5a5fc5a02e5438bbce6cb4b8cb18cb95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\TamKpIF8Lazl6Cp.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\TamKpIF8Lazl6Cp.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
76df6a260a9e33d73d159d1831e1ac96

SHA1
8534d89b97a050373c4412d927457cc9594d0b7b

SHA256
cfa46bd005a97edc5f2fd60f0d9dfdca0585ed9deba3eb2b249b80048a9c141b

SHA512
c3600045c22f87b04f810795760a9986219505b2d862b3bbb6bca0e8c4b10c9418d922916abede1e82aa5447a4579ebc3cdad4ccec2ae42963f838c57d55b9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
08a08466b0eccdbd4c1700cbe85f76ab

SHA1
dab611c93c8c36d2c34e83ab73b6006479a07c93

SHA256
5eaf42bbe794176369da1868e46ed3bec268ab8807cd15bccf7eb80150da225b

SHA512
2cb96ced627b549d50dec3464e3433a9f1d4d37f6f0c52cd2eb997bc0f09005a61cce3e1d2c6aa8351e4a6e981f862553e4554a0c7e07ae74c2d45218b9d2256

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\[email protected]\install.rdf

Filesize
594B

MD5
aee4b52d453a8801c9aea49b6c654a8c

SHA1
9083e3d10e1942b10b2f2d3d4d637896ee17b939

SHA256
98528afd77e9839266225971c441ef5ae21980b9f4687117120baf01dfff8e70

SHA512
7ea01da84e0e89c4595e59751a01577e0f8b14eb88094e6793002e54a73f38d80b113ddc3015cb347dc28257ae3947f852cc78f741af87794d16131d045990c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\pcnmckgbmmoepmbjddlaoogmgcapifnf\background.html

Filesize
143B

MD5
d828aadf082dadf4f2fd5cd30094a0ed

SHA1
1b8d8bfe863458b968cad6cfdedffc35b1ea3d9d

SHA256
fd99605d241aae15394222c53fec759d13c93443a9d2f2b97729efc69a1aac7e

SHA512
5d181b82d47e5dda441058c53dc92073464784385179dbaefff950843ae184751217be4dca99bd041bc3fcd8b4aa1e35213abbd33d4481048ea44bc228091e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\pcnmckgbmmoepmbjddlaoogmgcapifnf\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\pcnmckgbmmoepmbjddlaoogmgcapifnf\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\pcnmckgbmmoepmbjddlaoogmgcapifnf\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8BBA.tmp\pcnmckgbmmoepmbjddlaoogmgcapifnf\zgREjw.js

Filesize
6KB

MD5
1b0898c5cb9a4dfaabdc97ceb15a38a3

SHA1
b6994887203daef8c687dcf953ea1947e01bc4ff

SHA256
2d929d0d41d587a6dd1cb81d4af76ba4afc1d448b04fb80e7a4aff9b6d1ec66b

SHA512
f3c43fabb6e2445f71506b94f310dc186ce3521dbd42dcb0f39f21076e1b66f616094eee8fc3893a1bcaf15a39dd41f38208f1c23816adabd6dc6cd771765b51

Download Submit
memory/2728-132-0x0000000000000000-mapping.dmp

Download