612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe
Size

930KB
MD5

1ae3a43e449eb8fad7dfea6d742c71ce
SHA1

28885dd81cf5e68c3e25ee217838fb6e5d8b5e72
SHA256

612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633
SHA512

510820cad305e1c99ff58044a64993f7b7b729ecd78dc60830b4e61081d2c8a2db2bab99838ed45d0035ddb12024313b106ad9834db527f5daa78e7524c69d3a
SSDEEP

24576:h1OYdaOYMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpft:h1OsqMWyUQ+GUVFIcHPvpft

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

48sAdpDX1cmXykb.exe

pid process

2004 48sAdpDX1cmXykb.exe
Loads dropped DLL 1 IoCs

Processes:

612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe

pid process

544 612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
544	612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe

Drops Chrome extension 3 IoCs

Processes:

48sAdpDX1cmXykb.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fncajlogcplkhpldjppahnpfmahmodlj\2.0\manifest.json	48sAdpDX1cmXykb.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fncajlogcplkhpldjppahnpfmahmodlj\2.0\manifest.json	48sAdpDX1cmXykb.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fncajlogcplkhpldjppahnpfmahmodlj\2.0\manifest.json	48sAdpDX1cmXykb.exe

Drops file in System32 directory 4 IoCs

Processes:

48sAdpDX1cmXykb.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	48sAdpDX1cmXykb.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	48sAdpDX1cmXykb.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	48sAdpDX1cmXykb.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	48sAdpDX1cmXykb.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

48sAdpDX1cmXykb.exe

pid	process
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe
2004	48sAdpDX1cmXykb.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

48sAdpDX1cmXykb.exe

description	pid	process
Token: SeDebugPrivilege	2004	48sAdpDX1cmXykb.exe
Token: SeDebugPrivilege	2004	48sAdpDX1cmXykb.exe
Token: SeDebugPrivilege	2004	48sAdpDX1cmXykb.exe
Token: SeDebugPrivilege	2004	48sAdpDX1cmXykb.exe
Token: SeDebugPrivilege	2004	48sAdpDX1cmXykb.exe
Token: SeDebugPrivilege	2004	48sAdpDX1cmXykb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe

description	pid	process	target process
PID 544 wrote to memory of 2004	544	612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe	48sAdpDX1cmXykb.exe
PID 544 wrote to memory of 2004	544	612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe	48sAdpDX1cmXykb.exe
PID 544 wrote to memory of 2004	544	612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe	48sAdpDX1cmXykb.exe
PID 544 wrote to memory of 2004	544	612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe	48sAdpDX1cmXykb.exe

C:\Users\Admin\AppData\Local\Temp\612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe
"C:\Users\Admin\AppData\Local\Temp\612883550ff35c91b8ead7a681cf22b34b887e834512956002459bbc26645633.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\48sAdpDX1cmXykb.exe
.\48sAdpDX1cmXykb.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\48sAdpDX1cmXykb.dat

Filesize
1KB

MD5
7bbe67335b94f096f699bae4b4a464d6

SHA1
48af806c4efd44e1acbf3636fd7891e87cdb8c3c

SHA256
64fb4b1fc8d5cb4167e9d589232e086a305242a191c7b6abed5eed7972243a19

SHA512
895a6a0429a99df080cd90a0ba95de60dc2ab247bad2f214cd4bf6a92da5f483bb1db435e919fde267a921330abc1bf6377198d340d86daedb493c1ada79e143

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\48sAdpDX1cmXykb.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
a4eeafaed77f4684a8ea3ab32136e75c

SHA1
72cd9b2f226e2b003ec86e4fbfa494a4088233ba

SHA256
7c6081e21b610c40ebbda786c60a3e38febecb408b67f65e6a72e276996e6243

SHA512
6bafdbfc209d1554fd1dd36868833759e68049df0faf2cd8b744614e83462e9f459797667f7b3e3e7ab99e93ff99626f9cf2ceb83b9a9f7605965e3db53dcb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
c244ac0310cff45bec9d8b60b8d00e80

SHA1
cafc83b3b43b89777a10b46c96692f6a09845986

SHA256
766cd9825a274568c1a93753755224b6fb94341048a8beb832e5cca710c59538

SHA512
4b1f987d75731c4f42bac04dab7f8cbf36229ca236c407722df7717dd1b6465603cdb2c347962af4456f9b4de61769bdcf9fdb86bbddf2c86e604513a5f111b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\[email protected]\install.rdf

Filesize
595B

MD5
3f5d31ae783be781f756f3ab7ffd9d02

SHA1
ea51142667c40797e1b3653eecdd30ed1d32e0ee

SHA256
aecad63600419697e57059abbb096e2098fd2add87470ff45bdca0b2bcdcb70c

SHA512
0429dcff11f27cb037781055982bfa680c4faf9c8d175aba5f072394f7c65473a320dbdb143f84f3b2c2bdf7d9bbe531d0e13dce01003a6cee842e081d86b6d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\fncajlogcplkhpldjppahnpfmahmodlj\background.html

Filesize
144B

MD5
8d310333c9bf033d3985b5efe5f99e2e

SHA1
6f056e96f6e4c38073c2f59a6bd27d2b8427bbd6

SHA256
6c760622afab3369bceaa181aebcd3cb21059ace3f9a222dc01ab037f701b21f

SHA512
0ba6c54b6fdfb907a36916eb6223caa2131ffa876783e4e211a3f386992d23213a3acf193d0f89a7d69138ff1c7468a9d5a42f02b16c99a193469d58fd666d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\fncajlogcplkhpldjppahnpfmahmodlj\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\fncajlogcplkhpldjppahnpfmahmodlj\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\fncajlogcplkhpldjppahnpfmahmodlj\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\fncajlogcplkhpldjppahnpfmahmodlj\paj4UWR.js

Filesize
6KB

MD5
ba1e3fa6c44716b5937b8129a1ab4469

SHA1
4227c7481f706fed794e2cee781d395154e3e9ff

SHA256
a9d6c462c329b8d01e2ae915e964d01f3f6d0ef935dbc2957a48e09edd809d86

SHA512
f42ad08ca5526063c5b059b132fa3f56c3c34993ace069cbb337521d88c2658e215f8e03a03a12805539fcaa6d3173359b3a19bb370a5440fbf31557b7988562

Download Submit
\Users\Admin\AppData\Local\Temp\7zS6D35.tmp\48sAdpDX1cmXykb.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/544-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000000000000-mapping.dmp

Download