a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe
Size

931KB
MD5

73e430578174eda029c1ac55759947f9
SHA1

db6d424eeee142479e583e46d275e8a687584109
SHA256

a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b
SHA512

b5dcc2740ae7dd682bf27226e604cc4383d957b6dcf6ec33e30c65766f72907ea6f5ce17a8c23ff7dd5640d64c6385cf01498d97721ac1b00d0c3ab18c85a8b8
SSDEEP

24576:h1OYdaONMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfR:h1Os3MWyUQ+GUVFIcHPvpfR

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

xK4TBzX1GpEyKTn.exe

pid process

2192 xK4TBzX1GpEyKTn.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

xK4TBzX1GpEyKTn.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\npihbggmlghgkhooooaffjgemlaejope\2.0\manifest.json	xK4TBzX1GpEyKTn.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\npihbggmlghgkhooooaffjgemlaejope\2.0\manifest.json	xK4TBzX1GpEyKTn.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\npihbggmlghgkhooooaffjgemlaejope\2.0\manifest.json	xK4TBzX1GpEyKTn.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\npihbggmlghgkhooooaffjgemlaejope\2.0\manifest.json	xK4TBzX1GpEyKTn.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\npihbggmlghgkhooooaffjgemlaejope\2.0\manifest.json	xK4TBzX1GpEyKTn.exe

Drops file in System32 directory 4 IoCs

Processes:

xK4TBzX1GpEyKTn.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	xK4TBzX1GpEyKTn.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	xK4TBzX1GpEyKTn.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	xK4TBzX1GpEyKTn.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	xK4TBzX1GpEyKTn.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

xK4TBzX1GpEyKTn.exe

pid	process
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe
2192	xK4TBzX1GpEyKTn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

xK4TBzX1GpEyKTn.exe

description	pid	process
Token: SeDebugPrivilege	2192	xK4TBzX1GpEyKTn.exe
Token: SeDebugPrivilege	2192	xK4TBzX1GpEyKTn.exe
Token: SeDebugPrivilege	2192	xK4TBzX1GpEyKTn.exe
Token: SeDebugPrivilege	2192	xK4TBzX1GpEyKTn.exe
Token: SeDebugPrivilege	2192	xK4TBzX1GpEyKTn.exe
Token: SeDebugPrivilege	2192	xK4TBzX1GpEyKTn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe

description	pid	process	target process
PID 2188 wrote to memory of 2192	2188	a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe	xK4TBzX1GpEyKTn.exe
PID 2188 wrote to memory of 2192	2188	a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe	xK4TBzX1GpEyKTn.exe
PID 2188 wrote to memory of 2192	2188	a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe	xK4TBzX1GpEyKTn.exe

C:\Users\Admin\AppData\Local\Temp\a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe
"C:\Users\Admin\AppData\Local\Temp\a8ab9b2d71bb5c8f5c9a1c4ed537a4cbed61de55d83ad15288e2fb6281aabd1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\xK4TBzX1GpEyKTn.exe
.\xK4TBzX1GpEyKTn.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
7f32d2fd1c48652ab7d5211523f0514e

SHA1
e13b2c6988bff52fdf9bd1004429ff50a60db2e4

SHA256
406691ead1ac54a3ff3f1a9b1ee7753590d175ad421b62e8de4ea2ba96acb7c7

SHA512
2aaedca45a9a223bba5dcc6b739834a6e20f08c4d4e2eae543168347ae888292077d07e959e8d7ae05b1832673279168d02209e6cafde7ac0efde4c248a2fc0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
8880bd3c002ade07b693da3f2c7f960b

SHA1
f411e84b025b274bf59414bf598abade5f56c313

SHA256
8327b1a67d621b4b44b23e1ee015af7d036d3e91a71fca2da1b5ac3c61c07202

SHA512
d5f0aaa3f24e5e605b39eafc6f2bf034ba2fbdeeb99907229e1f98954a560be737a27fa4aa4446c25e2b5dbe10e21a8c5d1b8aa80232dcf43a191e76aa12d504

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\[email protected]\install.rdf

Filesize
593B

MD5
b4620872db69efe7da2730bea8bf5a9d

SHA1
50bb183d9896f8918ab9170dd94a230f1727a2a2

SHA256
c8b64ff12b9da344db91079525a247b84935e7a9689c4b88ab5aa5d9d1d1ba46

SHA512
7b71aa7eed86e5f0b50847d8bcc67637896f6f42c57824853a0af22174032eebdfbf34554635a6618b9c71fe01f36088efa91cdd5e2c43c02eeb3accc5db0783

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\npihbggmlghgkhooooaffjgemlaejope\background.html

Filesize
143B

MD5
713bf7cbe49d20f3e7edb84f14ffe500

SHA1
8ff5f467732591c6298f4eacac64a069ece593a0

SHA256
d15617d0900a47aa3ad5dbd7dd80381649749b61ded9b5cdf3a86964c01aac25

SHA512
2004038f4801d8be347a0cde5b5010e4aef9463b00968f1e7381ce288462d9a92132cf4ed8487ad6c6ded44f7ff84a9915ca4a5b9d485b3ae1afd5e186716b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\npihbggmlghgkhooooaffjgemlaejope\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\npihbggmlghgkhooooaffjgemlaejope\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\npihbggmlghgkhooooaffjgemlaejope\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\npihbggmlghgkhooooaffjgemlaejope\tn4uHV.js

Filesize
6KB

MD5
2afcf01075337923ea9f4713320c35ed

SHA1
55f70f9c80f5996139822f05e0c46e3f6a1ed82d

SHA256
57b35548632ff276820d01d324d4b4803b0ea063faa6a32e2e2e7ecdf12745f2

SHA512
5853714010510959f125b4c4d7e847f6a3fae6bd345f3dd6a92dc405f0f47c128c856ef386ffe33c6929bf1c99fb5b99beacd4e25b17836520f732f57710179a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\xK4TBzX1GpEyKTn.dat

Filesize
1KB

MD5
6d34edacf138be5eb93ca1e351983804

SHA1
1fb3e8abff271522ca6d8b062dcefdd9f3ad038d

SHA256
22f2375714f07e47f43d618ab9e7eabc0572852910db4e86d8dcf74443b3f7a6

SHA512
27da403c05749650964a646cbcfd226e6750fb7ba90309be0235cea7db31bc1290c2b734c77e8c82477c7cb14c7b675004d0cd6c5f2ab6931baa42c9980ad5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\xK4TBzX1GpEyKTn.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB1D0.tmp\xK4TBzX1GpEyKTn.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/2192-132-0x0000000000000000-mapping.dmp

Download