b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035

Analysis

max time kernel
153s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe
Size

931KB
MD5

6a4c9322f510f87d6306b4f859926151
SHA1

7dc006e8d15e7e4ad42a90c660f611a69542f72c
SHA256

b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035
SHA512

6b444ac9754c1a170fc6860f5834574dc91bf2b1be7cc136ae89dc06b398d007a765cfaf168bd2e28d98d4516f320c02cc14d358d9a953f744fd45d5e2e18355
SSDEEP

24576:h1OYdaOUMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfV:h1OsiMWyUQ+GUVFIcHPvpfV

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

qPeLx0kjYWD9CWi.exe

pid process

4120 qPeLx0kjYWD9CWi.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

qPeLx0kjYWD9CWi.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json	qPeLx0kjYWD9CWi.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json	qPeLx0kjYWD9CWi.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json	qPeLx0kjYWD9CWi.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json	qPeLx0kjYWD9CWi.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbmbhmnleicjehbmmphiplkfgoichjo\2.0\manifest.json	qPeLx0kjYWD9CWi.exe

Drops file in System32 directory 4 IoCs

Processes:

qPeLx0kjYWD9CWi.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	qPeLx0kjYWD9CWi.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	qPeLx0kjYWD9CWi.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	qPeLx0kjYWD9CWi.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	qPeLx0kjYWD9CWi.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

qPeLx0kjYWD9CWi.exe

pid	process
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe
4120	qPeLx0kjYWD9CWi.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

qPeLx0kjYWD9CWi.exe

description	pid	process
Token: SeDebugPrivilege	4120	qPeLx0kjYWD9CWi.exe
Token: SeDebugPrivilege	4120	qPeLx0kjYWD9CWi.exe
Token: SeDebugPrivilege	4120	qPeLx0kjYWD9CWi.exe
Token: SeDebugPrivilege	4120	qPeLx0kjYWD9CWi.exe
Token: SeDebugPrivilege	4120	qPeLx0kjYWD9CWi.exe
Token: SeDebugPrivilege	4120	qPeLx0kjYWD9CWi.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe

description	pid	process	target process
PID 2000 wrote to memory of 4120	2000	b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe	qPeLx0kjYWD9CWi.exe
PID 2000 wrote to memory of 4120	2000	b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe	qPeLx0kjYWD9CWi.exe
PID 2000 wrote to memory of 4120	2000	b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe	qPeLx0kjYWD9CWi.exe

C:\Users\Admin\AppData\Local\Temp\b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe
"C:\Users\Admin\AppData\Local\Temp\b77fef9df041db743028cc694beed91880b0675501daf9f9ce08657c07407035.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\qPeLx0kjYWD9CWi.exe
.\qPeLx0kjYWD9CWi.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
05f89ea14316e6d50d7bb0ae7fa6e7d1

SHA1
fe65eae601562442cd95698ac229c8d2d74b4a22

SHA256
c63bf270437c1e7854aea1d54b2cf02259805871fb7c19fe0b64c103112c7baf

SHA512
74bf1ad59cf46025afd3269f25627769f5a7fe6bedcbf516f74d642b8fbd5772f6edaed9e75a164cc8e22eafe0ca91252e7f3c973a24ed176fe358b2c52c5a83

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
44a55655ae377858cb5763a28d351903

SHA1
f9e9e8e66b830aa48fae9248bb508742888586c9

SHA256
21cdc51b3b8ed1525cb23379203d58338e613099a42fb7a6a9dd455a4031c91b

SHA512
94ba5bdb3031d559fc4c72c2be73527141e7b8f8b258ad7985577c3a76f7d99b9d5d3ab93c20978550bf866ebccbd73da0e7aed3e6aefa1eda0d8a357f8235fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\[email protected]\install.rdf
Filesize
593B

MD5
c9af0a548759d49ca53843055c2f9ba3

SHA1
5478f0cd05b94cb13654e270ea65d02b0e24fd10

SHA256
57a03352a6c249dbba079a5bfdd2691621fe790f2f697ce6d51368bf941af4d5

SHA512
4854df25c5661cb235520f0fe03faf3412b1722ecf970ac63c052bc66c71f3266dfbcdec5b86f71202f778be1e132cf45c2c43bb2ec32ceaa35f0e6d5b6a533f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\X5hgZfpm.js
Filesize
6KB

MD5
90cb63ab5e596034e0568048f6eaf22a

SHA1
3a68b562a7b8bb9dc30f4a5630e426c1ea4941ad

SHA256
726fbd33e3c1473d68f4cb3b339f4ad5dd4372147af9a28193dc453b938bf38c

SHA512
e726db2ec46b90bbe23744b29d9f133af7e87c81181a9c72904e17e68de75f4c85d2813b01734731f742ae9fd5448812fde6f9d849a26d8069e041eb21a0281d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\background.html
Filesize
145B

MD5
5b6bbe479b0681dd2d5c69a38840ecc8

SHA1
4dca97176d15167f727afec280dd85a17de5b749

SHA256
89c834214a9648375551799754b6af8d5f2d59dd3a6feb171e97f3d59062f8b4

SHA512
f560e2c8c206ed6619828df48f6f784bfea23e09fdaf15baf54d1892fe51807dcbb4d49162fd83f7e359f6d9ebd9c2cc965bee41c7622f4947a7f75e119c366a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\mdbmbhmnleicjehbmmphiplkfgoichjo\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\qPeLx0kjYWD9CWi.dat
Filesize
1KB

MD5
7b986a41c354609da069cf67f40afbea

SHA1
da810fe940ab1c3ddcf1cd95a41d9cfb3081ee9a

SHA256
17d32ea73cc304a3f870a39e1320cb4532be927ab72abad170c396330384c830

SHA512
77165ddb3718902a8eb7388954368854192358c74a60c06bd3f994eb94ec4ac28db7d330df4053798f5aec057002029b51a339ce98de02216e834c068dcfa8db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\qPeLx0kjYWD9CWi.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1FDC.tmp\qPeLx0kjYWD9CWi.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/4120-132-0x0000000000000000-mapping.dmp

Download