75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e

Analysis

max time kernel
64s
max time network
70s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe
Size

931KB
MD5

5b8e83ba9dad8b60faab4ac1ce55dfe1
SHA1

0f841eff759612991654b7fb92ba6bc3a93d8d2e
SHA256

75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e
SHA512

47689f9fef4e275c6b69debf7418941ffe38018bdf17aa2e8ad620735b01fe62fe3bab4be4ff1f526081cc04acbb2d91bae4c48a6a3be89df9518455addf440a
SSDEEP

24576:h1OYdaOaMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfM:h1OsAMWyUQ+GUVFIcHPvpfM

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1040	KOSaWyAM2gqe53Z.exe

Loads dropped DLL 1 IoCs

pid	Process
1420	75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\njanlbfbgeephnlcmpjjlpfddmhgkkep\2.0\manifest.json	KOSaWyAM2gqe53Z.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\njanlbfbgeephnlcmpjjlpfddmhgkkep\2.0\manifest.json	KOSaWyAM2gqe53Z.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\njanlbfbgeephnlcmpjjlpfddmhgkkep\2.0\manifest.json	KOSaWyAM2gqe53Z.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	KOSaWyAM2gqe53Z.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	KOSaWyAM2gqe53Z.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	KOSaWyAM2gqe53Z.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	KOSaWyAM2gqe53Z.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe
1040	KOSaWyAM2gqe53Z.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	KOSaWyAM2gqe53Z.exe
Token: SeDebugPrivilege	1040	KOSaWyAM2gqe53Z.exe
Token: SeDebugPrivilege	1040	KOSaWyAM2gqe53Z.exe
Token: SeDebugPrivilege	1040	KOSaWyAM2gqe53Z.exe
Token: SeDebugPrivilege	1040	KOSaWyAM2gqe53Z.exe
Token: SeDebugPrivilege	1040	KOSaWyAM2gqe53Z.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1040	1420	75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe	28
PID 1420 wrote to memory of 1040	1420	75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe	28
PID 1420 wrote to memory of 1040	1420	75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe	28
PID 1420 wrote to memory of 1040	1420	75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe	28

C:\Users\Admin\AppData\Local\Temp\75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe
"C:\Users\Admin\AppData\Local\Temp\75cc3060ed1d5edff52742f7e536af7234fd70b6f906568702892c9ae530fc1e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\KOSaWyAM2gqe53Z.exe
  .\KOSaWyAM2gqe53Z.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\KOSaWyAM2gqe53Z.dat

Filesize
1KB

MD5
200b6f7b550a36f70c31a090c43a73e6

SHA1
cc48abb64276b821a0d7b07562532fcb43e1d0b4

SHA256
324bf3114e8ca89e090fd6733e5e1133aad5aa2981d91b368837ab416d000dfd

SHA512
0ca5f814ef63fe2487a87b3f96582ff909b2bc603cb528bebeb776fa13e260698446087897bae7411af17fabff0d1de70ce633b49a419ed9aa4c7e51b354e151

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\KOSaWyAM2gqe53Z.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
16745204ebbd007ad1e8e6fae3dc69d5

SHA1
7e585bc86fce277418103c80832880bfa8d20ce2

SHA256
afa1055a2dd7edb6851c6f1da1254aa6ea2c6c8e7feaf81f3cd03ef5c34bd7a7

SHA512
a4bb5132dd626df58426a2ea4f3f3f7e68e90eb950802e2318652de91acae54944ef333cd7a51f268375b0f0f0ec0154cab51ef562bdc3ac7e1c2e85d1eb514e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
dbb2a81985e8b39b5318b03faa2b10ef

SHA1
b6daa47233c43fe8ab93d6b1bf7e704bd05d4059

SHA256
e9ed051b1db9d160bb9f06b14ce4a19c03c3545f95815222d37cde3592c32f22

SHA512
e9549de5a43fc75de8aa1858c9bdfd6da3cdeda4ff526fb9c9143019fcee4d1a1f9d4456e993a9f75c3d333ce35f29a28864a348e75cf7c67d201e8a701340a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\[email protected]\install.rdf

Filesize
594B

MD5
bb72661eadb698c7197fb82f230a6e65

SHA1
2db6cd571257a12d7bba5dfbf0e65c3eda2d7f67

SHA256
61c9b3884b10a31bd8f7c3845b84bb84d9daf39402c76bc9c50953fe61c6a0cc

SHA512
af64453e33e0e69e206390a7b7189562c6e6a8a2eb2c9f63af684833acce61ec5c9c713f7a07da72bfaa29737ce1bd8359bbd73f92088d6a84bbcd43fc31b37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\njanlbfbgeephnlcmpjjlpfddmhgkkep\background.html

Filesize
140B

MD5
3cc7384290c4c8f9ad3451a13328de41

SHA1
e762e9dafd2d68f9caeb0f75664a5129c7492255

SHA256
f4f6d1e16a65082f2f5e8279ee8a8178f201c05ef27ec8948e24545b2f73d081

SHA512
51b29669f37937e04033bef7ad987018d1aa64ec718b4b0e9fa004f1c0db3203c836eb1a6f16df1543c29e3a579e0a98a90c8b2ac8dbaf5687044c2b396f0913

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\njanlbfbgeephnlcmpjjlpfddmhgkkep\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\njanlbfbgeephnlcmpjjlpfddmhgkkep\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\njanlbfbgeephnlcmpjjlpfddmhgkkep\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA584.tmp\njanlbfbgeephnlcmpjjlpfddmhgkkep\vYE.js

Filesize
6KB

MD5
4e722a81dc156b52fa42c7a87b195d78

SHA1
d31b378bed945b81d9ec2e9bb32fbf092fa1e92b

SHA256
7a3365ba48253877d33a72e66fccfb84deaeb9c5dca624c3a6c06b1517a95c5a

SHA512
128061388b694383f0bb7c71dfb3a5bc8e28683d599b849664ac4e5304ef8accb0f8b0877a739ea87627e09e0a97a140cb44eb3197d8b64457b6e31c6b0c9606

Download Submit
\Users\Admin\AppData\Local\Temp\7zSA584.tmp\KOSaWyAM2gqe53Z.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/1420-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download