d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb

Analysis

max time kernel
57s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe
Size

924KB
MD5

baa888798b929faa52585239d4039271
SHA1

e747e48afc4269ba84cf0c74a8e5745173cb1ff5
SHA256

d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb
SHA512

673d3baf9e0e419713769b9fdc72cb698e21085736268baaa676dbd017e122e785e06f9e6aa7dca7cdba88f84a3e9e79d32123f505bd962a81118dbbb9366802
SSDEEP

24576:h1OYdaOlfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX/:h1OsAMN6wdBh5N5Z4E8PuX/

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1056	jmjTa3MrNztzvff.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\2.0\manifest.json	jmjTa3MrNztzvff.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\2.0\manifest.json	jmjTa3MrNztzvff.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\2.0\manifest.json	jmjTa3MrNztzvff.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	jmjTa3MrNztzvff.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	jmjTa3MrNztzvff.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	jmjTa3MrNztzvff.exe
File opened for modification	C:\Windows\System32\GroupPolicy	jmjTa3MrNztzvff.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe
1056	jmjTa3MrNztzvff.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	jmjTa3MrNztzvff.exe
Token: SeDebugPrivilege	1056	jmjTa3MrNztzvff.exe
Token: SeDebugPrivilege	1056	jmjTa3MrNztzvff.exe
Token: SeDebugPrivilege	1056	jmjTa3MrNztzvff.exe
Token: SeDebugPrivilege	1056	jmjTa3MrNztzvff.exe
Token: SeDebugPrivilege	1056	jmjTa3MrNztzvff.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1056	2020	d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe	28
PID 2020 wrote to memory of 1056	2020	d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe	28
PID 2020 wrote to memory of 1056	2020	d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe	28
PID 2020 wrote to memory of 1056	2020	d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe	28

C:\Users\Admin\AppData\Local\Temp\d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe
"C:\Users\Admin\AppData\Local\Temp\d6ea0782a3c00d0c291c2ff0621383c58bbe738c42d1fc8fbf6e5cb56d6054eb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\jmjTa3MrNztzvff.exe
  .\jmjTa3MrNztzvff.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
cd630a19231a157e2a16f354c7231293

SHA1
65bc191b2de54d861ab9ccde1a050dbcbf909513

SHA256
507497b193ad26d5c6c219c593ab04864ec1b613fab5e271ec5e8e2625ec9f7d

SHA512
70eae807704aa34e401b40cc5c47f64ed2fe7bcf7dedac8f884e70aae84c46a244865fceb79f6315868add0971b8501d52f824e0edf0421789be95deffca0d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
6fe68fb8037f768ba8e3e98194bbb985

SHA1
0ad64d9d1451eceaefee1461d1e9d4cdb17dbccd

SHA256
78133067a28486f6496323d11133b2b3b6c33a23eca40d550542c02c8dd7c522

SHA512
34eba80da22639a32d41ec4401909bc7cee76c48f50055fb3882e62e07ecb055c45b6ebd752d2c2bb650f2a37e28b6c29dbfe7ebca1d9bc52213817f5a4f202e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\[email protected]\install.rdf

Filesize
590B

MD5
1df992ff644251006672343a638d393d

SHA1
eb415461e0016ddec964e058df8fb82625cb0928

SHA256
29c402e985fe52ee2feb4392cab8335b42094d8c70ce3d7d64b2480f618e731a

SHA512
1a2c8104dd4396693097e4c7012b974818b75191a20c0377a609f5c72aac095ddd49b39b276376dae4100ff291fb2236df3733665b47c4a150c936faf25e8496

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\jmjTa3MrNztzvff.dat

Filesize
1KB

MD5
bb38945af7e1fac0975e59ab6ae8012c

SHA1
3fa93bed414ab181306b3874d7d1d7d9d00fa3bf

SHA256
162a2544011beb4b72a91dcda78b8c8131a78d5e786494edd640f7bde06474b5

SHA512
d5d1050a524fdfc4c0f14a9f2d7c5384a805042235d99029e33a777456948cb568c6bca3ec55e59d9a0d3f89c8a96477d88c838c9b8c4f39f1d40de64566c6e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\jmjTa3MrNztzvff.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\background.html

Filesize
144B

MD5
258c952e699e42a527f74c38081914a7

SHA1
b97be3e657fdb17a4f73eed68807e4eeeefb07df

SHA256
38d773e779fc483ac2b88113a908a5d4437a523d060fa213110d82bb157f4bdb

SHA512
8ff155751479679ce1889fde640647755bd633b1f86ad091cf217ed0d48a3c4121deb33d7c62bf4dc1a814f2243501fba880150e511f4d94f88298593250a3ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\wf2Rt2M.js

Filesize
6KB

MD5
e88c5082eaec76c6c5498755572a31df

SHA1
1c467a00c56dbcfb9c00e450056ebbb95552ce56

SHA256
eefa55648ab770efa696e3da1c5f95d8d737a18867b82283a7314e9a19b2a188

SHA512
e490b91fca8ecc6b5a280ec53b70fe085ec4360d92a3efc9a7d730ea6e46cfc9b780cd9f2e970f5449b5bdaff77ca5ef09e44cf59f2f268aa4e9a7eddd006820

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE13C.tmp\jmjTa3MrNztzvff.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
memory/2020-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download