0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd

Analysis

max time kernel
40s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe
Size

931KB
MD5

7e7ad9e9e0cb5a907e965b0f4a7a4e60
SHA1

a4a2a55027ee8d31754a3e1ccbb72b6d337b05c5
SHA256

0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd
SHA512

9e291fede7e10dc3440886b86e424d69fcd85925ab4fb50ec9f57618f4939d10aa18ddcf0546153e3b64ee112215abf89d9f736ded115508ea8b2dee051dec60
SSDEEP

24576:h1OYdaO/MWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfP:h1OslMWyUQ+GUVFIcHPvpfP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

8kOXJGRY82MiCWo.exe

pid process

960 8kOXJGRY82MiCWo.exe
Loads dropped DLL 1 IoCs

Processes:

0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe

pid process

1492 0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1492	0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe

Drops Chrome extension 3 IoCs

Processes:

8kOXJGRY82MiCWo.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hciklbnibcdkgllidimdfmekhokffiad\2.0\manifest.json	8kOXJGRY82MiCWo.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hciklbnibcdkgllidimdfmekhokffiad\2.0\manifest.json	8kOXJGRY82MiCWo.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hciklbnibcdkgllidimdfmekhokffiad\2.0\manifest.json	8kOXJGRY82MiCWo.exe

Drops file in System32 directory 4 IoCs

Processes:

8kOXJGRY82MiCWo.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8kOXJGRY82MiCWo.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8kOXJGRY82MiCWo.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8kOXJGRY82MiCWo.exe
File opened for modification	C:\Windows\System32\GroupPolicy	8kOXJGRY82MiCWo.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

8kOXJGRY82MiCWo.exe

pid	process
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe
960	8kOXJGRY82MiCWo.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

8kOXJGRY82MiCWo.exe

description	pid	process
Token: SeDebugPrivilege	960	8kOXJGRY82MiCWo.exe
Token: SeDebugPrivilege	960	8kOXJGRY82MiCWo.exe
Token: SeDebugPrivilege	960	8kOXJGRY82MiCWo.exe
Token: SeDebugPrivilege	960	8kOXJGRY82MiCWo.exe
Token: SeDebugPrivilege	960	8kOXJGRY82MiCWo.exe
Token: SeDebugPrivilege	960	8kOXJGRY82MiCWo.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe

description	pid	process	target process
PID 1492 wrote to memory of 960	1492	0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe	8kOXJGRY82MiCWo.exe
PID 1492 wrote to memory of 960	1492	0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe	8kOXJGRY82MiCWo.exe
PID 1492 wrote to memory of 960	1492	0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe	8kOXJGRY82MiCWo.exe
PID 1492 wrote to memory of 960	1492	0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe	8kOXJGRY82MiCWo.exe

C:\Users\Admin\AppData\Local\Temp\0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe
"C:\Users\Admin\AppData\Local\Temp\0809759dbc32b650a8cd0f2ffd3cc3f06f14ac56fff6ba33c9593f59644dcebd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\8kOXJGRY82MiCWo.exe
.\8kOXJGRY82MiCWo.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\8kOXJGRY82MiCWo.dat
Filesize
1KB

MD5
b45150a09badfcc3f07bd2bed9ee1735

SHA1
70a5f652b0787a1aa26ea85b517ad88943c6c971

SHA256
ddaef8f4d3c7f01e449b25e29e68e4297d42d2d8742857454216622f7ac54092

SHA512
26c57acafd2d466c8b0836d0248d944da59c40f36c39341ea45c0d0d53b4797315093ad5a6d6693c89036b616d368358c7a9866650f69696c565997088a8fd7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\8kOXJGRY82MiCWo.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\hciklbnibcdkgllidimdfmekhokffiad\background.html
Filesize
141B

MD5
4b4c3fd27a054a7b57c1abe3f80129a3

SHA1
4e333ca9b6f19ebe25872a7f5cdff18e8b71165a

SHA256
8252a00539e88d887dbc02a32fc97290bd45583f74cd8146a37a159ae4e4bb60

SHA512
fd395512ba1db9b1f4e5bb173df9c4395a010c257639844c596f81f865c4475115255a320c26dc5b5f20f880a74ae68968939e0256067839a13e3b2799939d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\hciklbnibcdkgllidimdfmekhokffiad\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\hciklbnibcdkgllidimdfmekhokffiad\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\hciklbnibcdkgllidimdfmekhokffiad\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\hciklbnibcdkgllidimdfmekhokffiad\xLWo.js
Filesize
6KB

MD5
bd69a1c1659a90cc43a4ae00cf90572d

SHA1
2848b449110ca0380b9ecf5035e145bdac75a00b

SHA256
0a12c2c6ff3f867ede3696aff7d703c7867a00611ba137107f375f34c929158b

SHA512
166bc378d658b624c65a78aa92749145daea99853cfd9910bc3160cff9ebeffff0b12ce409e33f1d646beb24cad0f434665da5c60fc1322c3321ca887f30f279

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
3c2aa90c8e675db91b157fe158048321

SHA1
fa273a5d49b0d60ce5616ff02fae4f39ffcbef71

SHA256
d28b7c2e0e93a00ce886811de2f89cffcf6029c6bd42c36cabc1d8c561f32f8f

SHA512
5cf7e57ee3185881a45be7fded6dbbac50049eb96c7f4ff4deca24f45fec8a063332974690744880ea4a4bbea1360d808c80e4545732f251cbb0a31fb501d555

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
690773d77cd3edc01dbe548bb4722e0e

SHA1
4560222db613891848fa9909efdb0cc406969db3

SHA256
9e0d04322ed661bb930c2b33f20699755d5ff0438f38c23e316f29512386ee63

SHA512
6b98d8b5d1efe9569ab48562a72b38a1fc14659dfebc68228c0f5b4a1fbb6d25b9ede00a7b65fc56df31403498d2d9b41583c3547fdd4db4d2f29126ef7ba733

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS13A.tmp\[email protected]\install.rdf
Filesize
598B

MD5
2519ac4fa203eb254eff3df7e9ad1abf

SHA1
4c4c192356018f244ebf918d922033de01ebfa08

SHA256
57b19766202b2663f885433a5cb4ec12a802a6ca194938db5e3595c566900321

SHA512
577aaecadd3f9cf215b03b871d68d2711f0c3bf59c65d07ad5426474805901ab8e795c2750b5e4add5e3e33e44a521e60c531944811cfbd2f7af0eec158df482

Download Submit
\Users\Admin\AppData\Local\Temp\7zS13A.tmp\8kOXJGRY82MiCWo.exe
Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/960-56-0x0000000000000000-mapping.dmp

Download
memory/1492-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads