d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe
Size

931KB
MD5

70fd3d94f5984619eb19fd69b623a7d1
SHA1

8de9571727dc9c16e084107f0288788d02e8c7d4
SHA256

d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d
SHA512

c7b215749c7a6c12b1219169fd5c79156fd1e89f001782f3acda2de10463290799f221bddfc079474782a18834bfc1f5fe86ab37fa0b62bf826e894d5521faed
SSDEEP

24576:h1OYdaOUMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfz:h1Os+MWyUQ+GUVFIcHPvpfz

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

dzrb4dWkpV5woHz.exe

pid process

1516 dzrb4dWkpV5woHz.exe
Loads dropped DLL 1 IoCs

Processes:

d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe

pid process

2020 d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2020	d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe

Drops Chrome extension 3 IoCs

Processes:

dzrb4dWkpV5woHz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhomknlkndoeljhaepbkckcappcbgkpo\2.0\manifest.json	dzrb4dWkpV5woHz.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhomknlkndoeljhaepbkckcappcbgkpo\2.0\manifest.json	dzrb4dWkpV5woHz.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhomknlkndoeljhaepbkckcappcbgkpo\2.0\manifest.json	dzrb4dWkpV5woHz.exe

Drops file in System32 directory 4 IoCs

Processes:

dzrb4dWkpV5woHz.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dzrb4dWkpV5woHz.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	dzrb4dWkpV5woHz.exe
File opened for modification	C:\Windows\System32\GroupPolicy	dzrb4dWkpV5woHz.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	dzrb4dWkpV5woHz.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

dzrb4dWkpV5woHz.exe

pid	process
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe
1516	dzrb4dWkpV5woHz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dzrb4dWkpV5woHz.exe

description	pid	process
Token: SeDebugPrivilege	1516	dzrb4dWkpV5woHz.exe
Token: SeDebugPrivilege	1516	dzrb4dWkpV5woHz.exe
Token: SeDebugPrivilege	1516	dzrb4dWkpV5woHz.exe
Token: SeDebugPrivilege	1516	dzrb4dWkpV5woHz.exe
Token: SeDebugPrivilege	1516	dzrb4dWkpV5woHz.exe
Token: SeDebugPrivilege	1516	dzrb4dWkpV5woHz.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe

description	pid	process	target process
PID 2020 wrote to memory of 1516	2020	d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe	dzrb4dWkpV5woHz.exe
PID 2020 wrote to memory of 1516	2020	d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe	dzrb4dWkpV5woHz.exe
PID 2020 wrote to memory of 1516	2020	d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe	dzrb4dWkpV5woHz.exe
PID 2020 wrote to memory of 1516	2020	d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe	dzrb4dWkpV5woHz.exe

C:\Users\Admin\AppData\Local\Temp\d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe
"C:\Users\Admin\AppData\Local\Temp\d2897d16087b32701657e7f056f0f5f4c17bc1dcee90d5ff52873886fe4a8b5d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\dzrb4dWkpV5woHz.exe
.\dzrb4dWkpV5woHz.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
36d4a9d2d54de498c4702cad01b6bead

SHA1
a34be147fee5e576e9821cd578c58f821f8ddc88

SHA256
6dafb3e449fcb4454016060429119ad7a8ade2b6a157c20d291988824f72b6b7

SHA512
9f05718c3408a6119f7e3a7b2f1d592cd17fed3190d6d0c0f9c5e8bc2301f495441157f32d43150751ce21c8e3d02755734b284ec617f7a94d9edfbe4e94766c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
7eb19b859f74161c2ac2fe7290e846af

SHA1
74366d45bed3707121bfc47c7cfb1f5706730824

SHA256
7922d382f979aed91c2431cd735a378669e6014140f05da73506c583ef2563bc

SHA512
dd565add7f4f650fe0090081314d42cadeafa380bcc5dad6eeeafc400b1a33275f5a0bd59dae5f03f35e8a937f66ea6979a6d31d0324b3e21750b953fd1c0acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\[email protected]\install.rdf

Filesize
597B

MD5
bfc5a7ce4378af75d794167371beb197

SHA1
3da4645ddd4b9510d7cb6565ab1b3d32ea5cc77e

SHA256
2c76aedb71bf78af7a765eabbe1ace5f5367fc5911edba13063fd7d4bf6f942f

SHA512
fb528001165ebd70a82c89479b9ae335475d5a65a80fa58a13abca222bcad2873d88c27f08a1c1e19baecfbd776e166feee7eee67e2f4fccccd5ff656fcda3c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\dzrb4dWkpV5woHz.dat

Filesize
1KB

MD5
4d14f6ad14b175c450884be316493b01

SHA1
3a51975a13709b177be0db25636cf08021217c64

SHA256
6061240f842bc9b47a980da06da04c2ef117c7bf0a2baf82f132e554f8531b88

SHA512
1e72f8fdfc2d8751657fdf91987d0aee8567ba9adaabb9b8d071cacacc51162768a4dff856b4e2b5484a51c0e3f5aeada0b3cadd74f333c23cfc8a86d17a1397

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\dzrb4dWkpV5woHz.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\lhomknlkndoeljhaepbkckcappcbgkpo\bYUDn39H3Q.js

Filesize
6KB

MD5
50986db333fbfe18652f85857c6e544f

SHA1
8ac5bbd47a1769b85819cc2e3a62362c00c5b4c3

SHA256
7d2796985d624debb2f8dee21717ec04bf7ca0fa94d4b170902f7dd9de61f42e

SHA512
5512271addca3f20afa8e51c4d93d76a1974af8d0582a3a8ed97d8c6b184d0ca422d358ca96f13137792c1175ede5ea2ca866419dc982e84b1900c030265dc03

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\lhomknlkndoeljhaepbkckcappcbgkpo\background.html

Filesize
147B

MD5
15911647a8b7c27a0a4e55b5acd9ab02

SHA1
01d8c3d400005dc2d1f6bc31ddc2a9ad9fbf5166

SHA256
af052511151e499964cc8e0afcbf434eb5fbec5d57a9d1884e5a741e5d2d44e3

SHA512
2d746ead3aa46b5a62b032a493ae0bd5bf55dcdec27855b7faddd23d4478c2fe96d9693a410d8c1f377f1410504657e254577a2442bb002226e17aa9b56ba33a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\lhomknlkndoeljhaepbkckcappcbgkpo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\lhomknlkndoeljhaepbkckcappcbgkpo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\lhomknlkndoeljhaepbkckcappcbgkpo\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS76A7.tmp\dzrb4dWkpV5woHz.exe

Filesize
771KB

MD5
e8ef8ed232808bfa240b33b376bb74a8

SHA1
b7ebfbda42fb24594210d3f97921c5b33b88585d

SHA256
a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

SHA512
24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

Download Submit
memory/1516-56-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download