Analysis
-
max time kernel
146s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 08:02
Static task
static1
Behavioral task
behavioral1
Sample
9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe
Resource
win7-20220812-en
General
-
Target
9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe
-
Size
931KB
-
MD5
d8da307f7342cfc17c28e8b9ccf6fa1b
-
SHA1
0a5e3dad26712d10ad56ed10bfd0974ae025e10c
-
SHA256
9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068
-
SHA512
872693c7a57d22e166932df33abe1c4ba48defab27c50f34e9804ca05a7778309b2fec637789ce92ed35f087ec702d82193b4aedea28b90187f8b408412fbe68
-
SSDEEP
24576:h1OYdaO6MWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfv:h1OsUMWyUQ+GUVFIcHPvpfv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cbbkAuWceB8hlV3.exepid process 4532 cbbkAuWceB8hlV3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
cbbkAuWceB8hlV3.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\poppgldfefgmidppilkdlgcajmlileaf\2.0\manifest.json cbbkAuWceB8hlV3.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\poppgldfefgmidppilkdlgcajmlileaf\2.0\manifest.json cbbkAuWceB8hlV3.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\poppgldfefgmidppilkdlgcajmlileaf\2.0\manifest.json cbbkAuWceB8hlV3.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\poppgldfefgmidppilkdlgcajmlileaf\2.0\manifest.json cbbkAuWceB8hlV3.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\poppgldfefgmidppilkdlgcajmlileaf\2.0\manifest.json cbbkAuWceB8hlV3.exe -
Drops file in System32 directory 4 IoCs
Processes:
cbbkAuWceB8hlV3.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI cbbkAuWceB8hlV3.exe File opened for modification C:\Windows\System32\GroupPolicy cbbkAuWceB8hlV3.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini cbbkAuWceB8hlV3.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol cbbkAuWceB8hlV3.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
cbbkAuWceB8hlV3.exepid process 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe 4532 cbbkAuWceB8hlV3.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cbbkAuWceB8hlV3.exedescription pid process Token: SeDebugPrivilege 4532 cbbkAuWceB8hlV3.exe Token: SeDebugPrivilege 4532 cbbkAuWceB8hlV3.exe Token: SeDebugPrivilege 4532 cbbkAuWceB8hlV3.exe Token: SeDebugPrivilege 4532 cbbkAuWceB8hlV3.exe Token: SeDebugPrivilege 4532 cbbkAuWceB8hlV3.exe Token: SeDebugPrivilege 4532 cbbkAuWceB8hlV3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exedescription pid process target process PID 4272 wrote to memory of 4532 4272 9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe cbbkAuWceB8hlV3.exe PID 4272 wrote to memory of 4532 4272 9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe cbbkAuWceB8hlV3.exe PID 4272 wrote to memory of 4532 4272 9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe cbbkAuWceB8hlV3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe"C:\Users\Admin\AppData\Local\Temp\9a23a931ebe9c0ff85124d3bb22ba55821ca27fc9a573cc44c0c66e1db83d068.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\cbbkAuWceB8hlV3.exe.\cbbkAuWceB8hlV3.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4316
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\cbbkAuWceB8hlV3.datFilesize
1KB
MD56eb652699952cdcb95228d7869127954
SHA1d18723cea98e90ef175585dc77798db353cd7b63
SHA256b6dd34b1a9e5866343dcaf4509bbcd905dada111f01f6dff3d1be6fd37ef8eeb
SHA5125b6cde491ec5d0030eee6a14d98be8741644475394bdc0f3619714e83a7add2c10b2784396a53b10b9c480d11b31953eb73649a13dc67f34937e8156d1604724
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\cbbkAuWceB8hlV3.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\cbbkAuWceB8hlV3.exeFilesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\[email protected]\chrome.manifestFilesize
35B
MD5266e4d1cb772b37e406fa6d02cdf2c3e
SHA1486a49da86d27c1b660f9d147d7a13cbdbb785a7
SHA256289ff7061996eaa7ad7e9a95657a5bbddbba228831f4a02ce360b97a549d3277
SHA512e0c55d74f73a605626b0039f458e9f38d9f5a96120aa348994761dd4c21b4edad9dbfb27d64ef809a7ae5e7d3e09024364fbf198898cb683d047ff11ab5b4216
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5ae5b5340170afb23230ae1ec3425ef0f
SHA15e89b206a5169901c4b32ffa1f6e81c7065feeeb
SHA256bda92503289496c994a9635f63fe9ca0767dd29b12493bac60541f6a1cc7af24
SHA512e5cabc4cdf3ee4fe5c7beb1bb251e14ee931f7d5b37a9c02c0ce0cbb3b05db1c1d7b7436b63bdc2ec553e83c9751c7f6aed5799f54bcdc73feb3e4c7695ba80e
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\[email protected]\install.rdfFilesize
595B
MD51dcbb9b2757c8177fbd4ee74a0235112
SHA168499dd74e8ac1b82620cff321ed9aa41b6d2018
SHA2561c63a0eb8d8cf32fd56502fda3470aaf31a626eb7d84bf7f10505a22618786b3
SHA512a142cdec7543caeb1d110f559cff59c8a8e37715b888176bc28d3732f1a9057d6f496d3122226779e29642490d1a955783c34f008dfdcf4f19ad7ea0827f9101
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\poppgldfefgmidppilkdlgcajmlileaf\background.htmlFilesize
139B
MD54d3567e9e6ffa45bc0f1af0de0d21ee5
SHA1a7ff82258712155e3d28f7e39257988ba1005a7e
SHA25666bbb066e1a6e4b9f9adc74266ac0a790ffc9fdfbe10171421875f0a64304bd9
SHA512ea0afc73d609d4de48ee5ad8b3daf3ce429494714ce64fc3eff4649af27bfc56f358725e5e8a5013c2ed5bf2635a9e80ab4b1b345bcacd5633cbf4b85af2ef48
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\poppgldfefgmidppilkdlgcajmlileaf\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\poppgldfefgmidppilkdlgcajmlileaf\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\poppgldfefgmidppilkdlgcajmlileaf\m0.jsFilesize
6KB
MD53ea2e9feaee80c91cedcd278fe89d3cf
SHA15a9bf683789ba67589dd35cf53eeebc218b7ef53
SHA256026638ab606f0ae5c5b6883297314809808a330aa2b80f5e7acf3edbd68d9a3f
SHA512d8c1235aa7b778f07cd38c77cd0e7590c3ebc119b7bf085c4e5440d02efc5f2a0e76358a5f3735357035ce0a7ecb92eb2a579a53658120c45fb8a3deef8c42a9
-
C:\Users\Admin\AppData\Local\Temp\7zS8889.tmp\poppgldfefgmidppilkdlgcajmlileaf\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4532-132-0x0000000000000000-mapping.dmp