Analysis
-
max time kernel
55s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 08:02
Static task
static1
Behavioral task
behavioral1
Sample
b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe
Resource
win7-20221111-en
General
-
Target
b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe
-
Size
931KB
-
MD5
6a4c9322f510f87d6306b4f859926151
-
SHA1
7dc006e8d15e7e4ad42a90c660f611a69542f72c
-
SHA256
b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035
-
SHA512
6b444ac9754c1a170fc6860f5834574dc91bf2b1be7cc136ae89dc06b398d007a765cfaf168bd2e28d98d4516f320c02cc14d358d9a953f744fd45d5e2e18355
-
SSDEEP
24576:h1OYdaOUMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfV:h1OsiMWyUQ+GUVFIcHPvpfV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qPeLx0kjYWD9CWi.exepid process 1188 qPeLx0kjYWD9CWi.exe -
Loads dropped DLL 1 IoCs
Processes:
b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exepid process 1628 b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
qPeLx0kjYWD9CWi.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json qPeLx0kjYWD9CWi.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json qPeLx0kjYWD9CWi.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json qPeLx0kjYWD9CWi.exe -
Drops file in System32 directory 4 IoCs
Processes:
qPeLx0kjYWD9CWi.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy qPeLx0kjYWD9CWi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini qPeLx0kjYWD9CWi.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol qPeLx0kjYWD9CWi.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI qPeLx0kjYWD9CWi.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
qPeLx0kjYWD9CWi.exepid process 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe 1188 qPeLx0kjYWD9CWi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
qPeLx0kjYWD9CWi.exedescription pid process Token: SeDebugPrivilege 1188 qPeLx0kjYWD9CWi.exe Token: SeDebugPrivilege 1188 qPeLx0kjYWD9CWi.exe Token: SeDebugPrivilege 1188 qPeLx0kjYWD9CWi.exe Token: SeDebugPrivilege 1188 qPeLx0kjYWD9CWi.exe Token: SeDebugPrivilege 1188 qPeLx0kjYWD9CWi.exe Token: SeDebugPrivilege 1188 qPeLx0kjYWD9CWi.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exedescription pid process target process PID 1628 wrote to memory of 1188 1628 b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe qPeLx0kjYWD9CWi.exe PID 1628 wrote to memory of 1188 1628 b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe qPeLx0kjYWD9CWi.exe PID 1628 wrote to memory of 1188 1628 b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe qPeLx0kjYWD9CWi.exe PID 1628 wrote to memory of 1188 1628 b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe qPeLx0kjYWD9CWi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe"C:\Users\Admin\AppData\Local\Temp\b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\qPeLx0kjYWD9CWi.exe.\qPeLx0kjYWD9CWi.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\[email protected]\chrome.manifestFilesize
35B
MD505f89ea14316e6d50d7bb0ae7fa6e7d1
SHA1fe65eae601562442cd95698ac229c8d2d74b4a22
SHA256c63bf270437c1e7854aea1d54b2cf02259805871fb7c19fe0b64c103112c7baf
SHA51274bf1ad59cf46025afd3269f25627769f5a7fe6bedcbf516f74d642b8fbd5772f6edaed9e75a164cc8e22eafe0ca91252e7f3c973a24ed176fe358b2c52c5a83
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\[email protected]\content\bg.jsFilesize
9KB
MD544a55655ae377858cb5763a28d351903
SHA1f9e9e8e66b830aa48fae9248bb508742888586c9
SHA25621cdc51b3b8ed1525cb23379203d58338e613099a42fb7a6a9dd455a4031c91b
SHA51294ba5bdb3031d559fc4c72c2be73527141e7b8f8b258ad7985577c3a76f7d99b9d5d3ab93c20978550bf866ebccbd73da0e7aed3e6aefa1eda0d8a357f8235fd
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\[email protected]\install.rdfFilesize
593B
MD5c9af0a548759d49ca53843055c2f9ba3
SHA15478f0cd05b94cb13654e270ea65d02b0e24fd10
SHA25657a03352a6c249dbba079a5bfdd2691621fe790f2f697ce6d51368bf941af4d5
SHA5124854df25c5661cb235520f0fe03faf3412b1722ecf970ac63c052bc66c71f3266dfbcdec5b86f71202f778be1e132cf45c2c43bb2ec32ceaa35f0e6d5b6a533f
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\X5hgZfpm.jsFilesize
6KB
MD590cb63ab5e596034e0568048f6eaf22a
SHA13a68b562a7b8bb9dc30f4a5630e426c1ea4941ad
SHA256726fbd33e3c1473d68f4cb3b339f4ad5dd4372147af9a28193dc453b938bf38c
SHA512e726db2ec46b90bbe23744b29d9f133af7e87c81181a9c72904e17e68de75f4c85d2813b01734731f742ae9fd5448812fde6f9d849a26d8069e041eb21a0281d
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\background.htmlFilesize
145B
MD55b6bbe479b0681dd2d5c69a38840ecc8
SHA14dca97176d15167f727afec280dd85a17de5b749
SHA25689c834214a9648375551799754b6af8d5f2d59dd3a6feb171e97f3d59062f8b4
SHA512f560e2c8c206ed6619828df48f6f784bfea23e09fdaf15baf54d1892fe51807dcbb4d49162fd83f7e359f6d9ebd9c2cc965bee41c7622f4947a7f75e119c366a
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\qPeLx0kjYWD9CWi.datFilesize
1KB
MD57b986a41c354609da069cf67f40afbea
SHA1da810fe940ab1c3ddcf1cd95a41d9cfb3081ee9a
SHA25617d32ea73cc304a3f870a39e1320cb4532be927ab72abad170c396330384c830
SHA51277165ddb3718902a8eb7388954368854192358c74a60c06bd3f994eb94ec4ac28db7d330df4053798f5aec057002029b51a339ce98de02216e834c068dcfa8db
-
C:\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\qPeLx0kjYWD9CWi.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
\Users\Admin\AppData\Local\Temp\7zSB8E4.tmp\qPeLx0kjYWD9CWi.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
memory/1188-56-0x0000000000000000-mapping.dmp
-
memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB