80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe
Size

925KB
MD5

0b014a33e968956d3e2b2c8bba08e2c2
SHA1

e2f9df76473a2a59ba0cc82746765b5f9a808f27
SHA256

80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c
SHA512

083fdd321b718a23394a0a837615aaff5c48742d9c6e9b2323cef19192a7e156ad4b2be3bf0041f03ef6ce74800d7d5a7d3c5ad4a4f7b30f77af13767802bcff
SSDEEP

24576:h1OYdaOOfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXf:h1Os7MN6wdBh5N5Z4E8PuXf

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

9uYCTfoDStiT3Lv.exe

pid process

2876 9uYCTfoDStiT3Lv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

9uYCTfoDStiT3Lv.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdncloeibpfimdncilpjfglceokdlda\2.0\manifest.json	9uYCTfoDStiT3Lv.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdncloeibpfimdncilpjfglceokdlda\2.0\manifest.json	9uYCTfoDStiT3Lv.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdncloeibpfimdncilpjfglceokdlda\2.0\manifest.json	9uYCTfoDStiT3Lv.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdncloeibpfimdncilpjfglceokdlda\2.0\manifest.json	9uYCTfoDStiT3Lv.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdncloeibpfimdncilpjfglceokdlda\2.0\manifest.json	9uYCTfoDStiT3Lv.exe

Drops file in System32 directory 4 IoCs

Processes:

9uYCTfoDStiT3Lv.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	9uYCTfoDStiT3Lv.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	9uYCTfoDStiT3Lv.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	9uYCTfoDStiT3Lv.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	9uYCTfoDStiT3Lv.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

9uYCTfoDStiT3Lv.exe

pid	process
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe
2876	9uYCTfoDStiT3Lv.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

9uYCTfoDStiT3Lv.exe

description	pid	process
Token: SeDebugPrivilege	2876	9uYCTfoDStiT3Lv.exe
Token: SeDebugPrivilege	2876	9uYCTfoDStiT3Lv.exe
Token: SeDebugPrivilege	2876	9uYCTfoDStiT3Lv.exe
Token: SeDebugPrivilege	2876	9uYCTfoDStiT3Lv.exe
Token: SeDebugPrivilege	2876	9uYCTfoDStiT3Lv.exe
Token: SeDebugPrivilege	2876	9uYCTfoDStiT3Lv.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe

description	pid	process	target process
PID 2540 wrote to memory of 2876	2540	80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe	9uYCTfoDStiT3Lv.exe
PID 2540 wrote to memory of 2876	2540	80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe	9uYCTfoDStiT3Lv.exe
PID 2540 wrote to memory of 2876	2540	80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe	9uYCTfoDStiT3Lv.exe

C:\Users\Admin\AppData\Local\Temp\80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe
"C:\Users\Admin\AppData\Local\Temp\80a824505761c54d7dd466e06c334f7ada2459f280f5ade9e0e8350c2416854c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540

C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\9uYCTfoDStiT3Lv.exe
.\9uYCTfoDStiT3Lv.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
fdcbfa9608bb070edc0b8085ff21f73d

SHA1
18536f37b736043f760521bdecfceabe17498c31

SHA256
699f6207f81d3f111657c4edc69b46ee85aeaec3f1cd191076764c59492aafc0

SHA512
7278ccf58156c3bec3bee280116f482248159094f940d18e4393d2f41fe14b7d7288da6bfc34771106e8b5010f99d06595c6f7e32a9ed0356a28f92e975a385d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
f89ed9812088a08391217c174ea9467f

SHA1
b570e767a57bc6efe5fd5aa6fa4e1c080c895351

SHA256
f5efe5b94c5851f3af29fef3f85a866d80f3e306aaa6e1557f7d0c1f54bddc94

SHA512
4e3060f7f536a9543e6475fabcbe97435016c460965b7a03091b4d07f0f5c2d2fc6bd31d98c54fa058e986cde8c6b20a6a06fec4c1390ef4eab7608f77974766

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\[email protected]\install.rdf

Filesize
591B

MD5
95d6314c81af990cbbf4b736491aa4fd

SHA1
2c6a4e28dadffc99112953fa898ad2410848fbce

SHA256
738e0be09f5af7de3eb503f8cb1739e20bf739c7a20d735f5d886048a17e3ce0

SHA512
223e198f9a74f999db96c129a2bafa2ebe3b9f49eb82eb67e16923033e3352366d8699a9f7b4e27095e0215cfa6d3cba25a52407dd54b7bd161945a19b246527

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\9uYCTfoDStiT3Lv.dat

Filesize
1KB

MD5
30ca01c9c957070ab98edc80a0d0b2f2

SHA1
9f002ff6be30b2fda83afead9e146673c65b0431

SHA256
9c1011883c295ed54f056b2043151ff1b786ff6d1c0e7acbf37451b00763b346

SHA512
f5bfb63386ba14d2f306a7ad07c16110f866cd95e2a8f2c997316c09220cd288218aa4ebb77e63713b5291f3c7759f1d20a4372f6fa7ae8cd940099a5aafbd5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\9uYCTfoDStiT3Lv.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\9uYCTfoDStiT3Lv.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\abdncloeibpfimdncilpjfglceokdlda\background.html

Filesize
139B

MD5
9ad117a5d78d86df8a4d81380eb80619

SHA1
5dcf2a43e8f1b93c93a66016f0bb98949d214e20

SHA256
c2332ea2ceabb1e0810b4ce46366670ddf1f7c5621e51714607a50e6922b8da0

SHA512
10cc0bf311e9f6db5224a3a69e1887721051782926a1c4750855af20e9e350f6194f825292c59aa1a55dfc943d2ebdfee97366058e1b430265933b883c7d3374

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\abdncloeibpfimdncilpjfglceokdlda\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\abdncloeibpfimdncilpjfglceokdlda\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\abdncloeibpfimdncilpjfglceokdlda\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79C8.tmp\abdncloeibpfimdncilpjfglceokdlda\uD.js

Filesize
6KB

MD5
d50bfdb7204b92daf65a16bb600e738b

SHA1
c460fc9e75765ec3e70f8b3e246c794a14ba5e23

SHA256
9c47d69d73b579689f5829c02e274713664b2d352c043e35e8ff4dd71176f706

SHA512
7cd26e983ea0800a7f162b38a5792f131407c49f8ec75bc7bbc1b0e1cdcc5ad5399c5393fb660de839405490399464a479890f67d99e0e77e033b177178c37b2

Download Submit
memory/2876-132-0x0000000000000000-mapping.dmp

Download