839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05

Analysis

max time kernel
198s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe
Size

924KB
MD5

b612250c775c0fe35b55d16304a00669
SHA1

361d3082f24210e2d3b7c194f67540c63926a614
SHA256

839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05
SHA512

ada08525bab46a43699a36d4a66c5f02d409180e3002acd874d4a1940f5af7693ac42473e03ab8f79d1a8775a9e771a11f8cf83635380cc96d2f54b014871be8
SSDEEP

24576:h1OYdaOMfC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXD:h1OsRMN6wdBh5N5Z4E8PuXD

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

6BPsDeoIs7Gfo5p.exe

pid process

3028 6BPsDeoIs7Gfo5p.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

6BPsDeoIs7Gfo5p.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\egflikjpfpbhomknkdocahdhafclknno\2.0\manifest.json	6BPsDeoIs7Gfo5p.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\egflikjpfpbhomknkdocahdhafclknno\2.0\manifest.json	6BPsDeoIs7Gfo5p.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\egflikjpfpbhomknkdocahdhafclknno\2.0\manifest.json	6BPsDeoIs7Gfo5p.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\egflikjpfpbhomknkdocahdhafclknno\2.0\manifest.json	6BPsDeoIs7Gfo5p.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\egflikjpfpbhomknkdocahdhafclknno\2.0\manifest.json	6BPsDeoIs7Gfo5p.exe

Drops file in System32 directory 4 IoCs

Processes:

6BPsDeoIs7Gfo5p.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	6BPsDeoIs7Gfo5p.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	6BPsDeoIs7Gfo5p.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	6BPsDeoIs7Gfo5p.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	6BPsDeoIs7Gfo5p.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

6BPsDeoIs7Gfo5p.exe

pid	process
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe
3028	6BPsDeoIs7Gfo5p.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

6BPsDeoIs7Gfo5p.exe

description	pid	process
Token: SeDebugPrivilege	3028	6BPsDeoIs7Gfo5p.exe
Token: SeDebugPrivilege	3028	6BPsDeoIs7Gfo5p.exe
Token: SeDebugPrivilege	3028	6BPsDeoIs7Gfo5p.exe
Token: SeDebugPrivilege	3028	6BPsDeoIs7Gfo5p.exe
Token: SeDebugPrivilege	3028	6BPsDeoIs7Gfo5p.exe
Token: SeDebugPrivilege	3028	6BPsDeoIs7Gfo5p.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe

description	pid	process	target process
PID 3036 wrote to memory of 3028	3036	839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe	6BPsDeoIs7Gfo5p.exe
PID 3036 wrote to memory of 3028	3036	839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe	6BPsDeoIs7Gfo5p.exe
PID 3036 wrote to memory of 3028	3036	839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe	6BPsDeoIs7Gfo5p.exe

C:\Users\Admin\AppData\Local\Temp\839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe
"C:\Users\Admin\AppData\Local\Temp\839dad8c62069789f3d5a3663a46a6dc81ccfe15ec5fdf3f351d0e9d70677c05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\6BPsDeoIs7Gfo5p.exe
.\6BPsDeoIs7Gfo5p.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\6BPsDeoIs7Gfo5p.dat

Filesize
1KB

MD5
70af1282f71be18e0ce6920f4c2bb86a

SHA1
3b33cee4791ead9cbb7024b21d266a168d61edc7

SHA256
0312eb464b6289144f7fcadc1b0ff691457b151986e6dd6a79224f8140208da6

SHA512
aba7c1ddc88c2155ba9f0616fa1031eef1eb231e81d786218c1266fa82459dd7d9efaa66a0df200f4a1707a7d1d7981f1a3be1006f37856f05549352c2a7820f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\6BPsDeoIs7Gfo5p.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\6BPsDeoIs7Gfo5p.exe

Filesize
765KB

MD5
21c7e6ab35acdb8d15ac0590900c5206

SHA1
bd696ab0d1806c5492b4444d96fe272f217f4058

SHA256
314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec

SHA512
775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\egflikjpfpbhomknkdocahdhafclknno\background.html

Filesize
145B

MD5
2158316f7a60f2e9985cc6e952c90bd0

SHA1
efbed3ca17b9f4e3e500e187d58136779491ee6b

SHA256
c62b8e79c1201e2e731d0843524bcd72f2fb0006cc5e16445b09c224af94820c

SHA512
d5f180e86d514cdffa0899cc513065181c97fe013aa1f0f6da1a3f652c774f2367926a34b0363f55ee992169769f3c82c176daf7ebb58b2ce71f72a0885048f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\egflikjpfpbhomknkdocahdhafclknno\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\egflikjpfpbhomknkdocahdhafclknno\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\egflikjpfpbhomknkdocahdhafclknno\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\egflikjpfpbhomknkdocahdhafclknno\xJmM79SI.js

Filesize
6KB

MD5
e7e52347c3b2420d2f0ea05ce94be62f

SHA1
0b174f7b8c14bf9e899f74ce5bfaf63139685add

SHA256
6e1269edaae7cb4d09873a3e9bcbe8608f357562468a87b2ffe73b79c7de9677

SHA512
892495f0a84f3e851d7a982042adfc0c3f7fd98d9b334248440a0cba9042e2573fb58234663eea8ede41944600da72ada88e6a1d3d14d0faa90f1dd86c9ffeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
cce7a4fd07186d2b4611bb5a4d91e909

SHA1
51a9c92d9dbb79db26dfa60e6082bd87337a8fee

SHA256
8128321de44b4e0344c9bc39670b11853f13d301d420d5b7b60f07c23c62b832

SHA512
e8e2aa3a06098185ef2402df004908c218a77429d63dd66beb87a16416852714e93160f772f1a26b82d51baf41ad66586faf217ffd34ad75a8fbc0be439a4953

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
81787f0b5c13813c9249125407f0217d

SHA1
53a4ad85bd039ffe4f612f69c44a9bd4b1169825

SHA256
0147aa5d1b86ebaf2b194e72767bd1afc9bf51ab9c7ead92a0816e3d70618fb1

SHA512
34441d4f4e63a30f3ab2ca29a968c515e049a0420321c2c18db632e3b017d45d9c402719dd741cf7029517a77775d787bd1f9bc69e65e2ab40f7583af5aee63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS591C.tmp\[email protected]\install.rdf

Filesize
590B

MD5
339db319d6ca40aa5603815fd55a5ef2

SHA1
1da45b34b53b9ba5827436d8b23f2fd2cd61976b

SHA256
47ffea2ff08941ad46d351d5186ae9f5d45800aeb7664ac9e8cfbd15551761ac

SHA512
76010a68cf0a2d393f3f2e7f47c34f4cc6c40dcbb7a175a953268a4b4ffe98fbd144c9fab2ae5016a1dd2340c3ee54052ddaebae77029f97a03dc668140f72e8

Download Submit
memory/3028-133-0x0000000000000000-mapping.dmp

Download