5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe
Size

931KB
MD5

1111c6c1200977fcad7e73329ad0b081
SHA1

0b00f71e9678c585b3cb331573c1b094cf9f95e5
SHA256

5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773
SHA512

f01035413b018e49d17ff73b401246cfe2430047c34ef641b6fe3f2cf239763a0a3568326b73d4377e0d851d7b3e4d40fcaa3ac6692517a7faefdb939d381da2
SSDEEP

24576:h1OYdaOtMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfH:h1OsjMWyUQ+GUVFIcHPvpfH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

RIzqgzAONjokG7o.exe

pid process

1532 RIzqgzAONjokG7o.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

RIzqgzAONjokG7o.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eicmkomihbiocpmahdkjejhopmggclkm\2.0\manifest.json	RIzqgzAONjokG7o.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eicmkomihbiocpmahdkjejhopmggclkm\2.0\manifest.json	RIzqgzAONjokG7o.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eicmkomihbiocpmahdkjejhopmggclkm\2.0\manifest.json	RIzqgzAONjokG7o.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eicmkomihbiocpmahdkjejhopmggclkm\2.0\manifest.json	RIzqgzAONjokG7o.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eicmkomihbiocpmahdkjejhopmggclkm\2.0\manifest.json	RIzqgzAONjokG7o.exe

Drops file in System32 directory 4 IoCs

Processes:

RIzqgzAONjokG7o.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	RIzqgzAONjokG7o.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	RIzqgzAONjokG7o.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	RIzqgzAONjokG7o.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	RIzqgzAONjokG7o.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

RIzqgzAONjokG7o.exe

pid	process
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe
1532	RIzqgzAONjokG7o.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RIzqgzAONjokG7o.exe

description	pid	process
Token: SeDebugPrivilege	1532	RIzqgzAONjokG7o.exe
Token: SeDebugPrivilege	1532	RIzqgzAONjokG7o.exe
Token: SeDebugPrivilege	1532	RIzqgzAONjokG7o.exe
Token: SeDebugPrivilege	1532	RIzqgzAONjokG7o.exe
Token: SeDebugPrivilege	1532	RIzqgzAONjokG7o.exe
Token: SeDebugPrivilege	1532	RIzqgzAONjokG7o.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe

description	pid	process	target process
PID 1260 wrote to memory of 1532	1260	5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe	RIzqgzAONjokG7o.exe
PID 1260 wrote to memory of 1532	1260	5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe	RIzqgzAONjokG7o.exe
PID 1260 wrote to memory of 1532	1260	5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe	RIzqgzAONjokG7o.exe

C:\Users\Admin\AppData\Local\Temp\5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe
"C:\Users\Admin\AppData\Local\Temp\5e853d1b830da532be7d4dd9aa829baee87e2dde38120444adfee0688a6dc773.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\RIzqgzAONjokG7o.exe
.\RIzqgzAONjokG7o.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\RIzqgzAONjokG7o.dat
Filesize
1KB

MD5
e7b07894363240a2bfe06e964309e555

SHA1
0dd763871d6473e4c28ddc4f0314b9c5138a5d34

SHA256
d27a308ddcc0a0abba65555cfeec08d40111d559d873518f4ac3311711ae5704

SHA512
a78449ade6fea264d25c7918932606a0c0d0da14e547868fb8237ed8ecb21fbf0b742abee749141898287a2b98e3f95a1f899892b6919aee30e3498fd8253f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\RIzqgzAONjokG7o.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\RIzqgzAONjokG7o.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
6e93d9d9284b683f3587ddcf48705f22

SHA1
0c50fc202bdbc26f56f18f581bfb29611736a40d

SHA256
dd11298298de3952f3796c1746820c57dbbd0d82ea1796722bd8f096c4cdc4c8

SHA512
36cd1e6c8d2196ad1770af69d8863304f48b09b77b5c95c170e603463f4038a23123fb34e36d9e51ce8c9a8e33fd0a20eb8bcaac99cd776558c07a23674482e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
2177b21e4b482bfa6ee1b048c691e36a

SHA1
24d19ba06181a6a87c816063b67acf9986da1ee2

SHA256
865e2b2f6a0af5f77eb2acfb8380f581311ec8998b50279a308df31f1e638c55

SHA512
92c1d975ede491552e168a35e483633cebcbc190c5f80c7522c9204e81554e6423b6467b188c90a1b47172eda8053e3244d728f433a64532426ef506603e9370

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\[email protected]\install.rdf
Filesize
598B

MD5
a8a87295a902f12ce3b2c7e5c75ab4cb

SHA1
86c051897986e7eac15f4388655dfcb819f01cd9

SHA256
bd972a971f45dd4d982e83f5272eaae3bcef09eea397d5a6bc07863d3a00f169

SHA512
0b36996d95a6acb24fb786780a160f938af5f0428d57dd9a1c540503983e82de2b40b79282f7f455d883cbcdfb5675de762d5c509ecd5b59928a3a9394d0f585

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\eicmkomihbiocpmahdkjejhopmggclkm\background.html
Filesize
144B

MD5
e370c3463db5bc94b97d4a7aaedd70d8

SHA1
2c492e22e16fc59ec83df74da0f6b1f031262625

SHA256
c45d3d47514349dfd4021b3054f9f5fae6d030ca57dbb0314b480c9a08554a7c

SHA512
36eb8a5bb8e89144f66c82af50fb964ed25fd3b13adc2f567c2f54bb5fb2c9330259e5def42207fa469ebcde593d1b5862daa263fa76c7472c8cb64626714272

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\eicmkomihbiocpmahdkjejhopmggclkm\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\eicmkomihbiocpmahdkjejhopmggclkm\hWC7EBQ.js
Filesize
6KB

MD5
89ceb89ab4ae48d308cb4691d55ef442

SHA1
59cd0dcbad7713ac10775b500189d30415be884f

SHA256
ee8c48c55d96b8bd116d2e9a74a7e8093f0eb078a5752027ff724490e275f723

SHA512
6e7ac655446c72ec1ea8c180795853aa15a2d269e6875bc0ed7e67cea9ca386dd78015e0d307bd2c9fddd6557205f452c01ffec7f8b479056a7669344b38ec4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\eicmkomihbiocpmahdkjejhopmggclkm\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC931.tmp\eicmkomihbiocpmahdkjejhopmggclkm\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1532-132-0x0000000000000000-mapping.dmp

Download