ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7

Analysis

max time kernel
279s
max time network
348s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7.exe
Size

937KB
MD5

7b9bbea48ee45cc40f06ab6d93ea813f
SHA1

88c61cec576cd987ef43bf4b7cebd38b3bb43ff9
SHA256

ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7
SHA512

9701de6ea10938717059d4988c386355e69f4381189d4d9b2b2e43f64b8e319f65451895143290dc9b990782a99b15b7db88d2e5a77ebf1c8f70e267f1f6c27f
SSDEEP

24576:h1OYdaOFE7PWrwXqiI8M8klwTokI1KZ9+:h1OsfE7PWmI85kqoaZ9+

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5100	k3bvGCq53ykTJpr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcbpmbjmjmpckboofheaonccgdkejif\2.0\manifest.json	k3bvGCq53ykTJpr.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcbpmbjmjmpckboofheaonccgdkejif\2.0\manifest.json	k3bvGCq53ykTJpr.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcbpmbjmjmpckboofheaonccgdkejif\2.0\manifest.json	k3bvGCq53ykTJpr.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcbpmbjmjmpckboofheaonccgdkejif\2.0\manifest.json	k3bvGCq53ykTJpr.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcbpmbjmjmpckboofheaonccgdkejif\2.0\manifest.json	k3bvGCq53ykTJpr.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	k3bvGCq53ykTJpr.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	k3bvGCq53ykTJpr.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	k3bvGCq53ykTJpr.exe
File opened for modification	C:\Windows\System32\GroupPolicy	k3bvGCq53ykTJpr.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe
5100	k3bvGCq53ykTJpr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	k3bvGCq53ykTJpr.exe
Token: SeDebugPrivilege	5100	k3bvGCq53ykTJpr.exe
Token: SeDebugPrivilege	5100	k3bvGCq53ykTJpr.exe
Token: SeDebugPrivilege	5100	k3bvGCq53ykTJpr.exe
Token: SeDebugPrivilege	5100	k3bvGCq53ykTJpr.exe
Token: SeDebugPrivilege	5100	k3bvGCq53ykTJpr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 5100	732	ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7.exe	80
PID 732 wrote to memory of 5100	732	ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7.exe	80
PID 732 wrote to memory of 5100	732	ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7.exe	80

C:\Users\Admin\AppData\Local\Temp\ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7.exe
"C:\Users\Admin\AppData\Local\Temp\ab2d092636f24d46a85dee19ad718ecc0db7810a7b9c6e5ab83dfc57e0698ed7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\k3bvGCq53ykTJpr.exe
  .\k3bvGCq53ykTJpr.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
5f2791b176ada08a16ebc26364284b6c

SHA1
521422dc19ec1ed368c49fdd63a6cb2a539239f0

SHA256
5ea189c99ede823a3d60a70222a4f4444951173f283c54beb150b8f443c6b4cb

SHA512
e3638dc0b1d012fe931ed4467134083a3008ae13b59ab79af05c30eae0e5cb577d9e0c12977602b739bbcfef9997494de6d2e9f6bace01f6f71aa7d63fdf4fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
b2ba3cecfd8838d6e29b61603e4e5b27

SHA1
d01c14a2dbf61a4acb9de3fd64802f07ad71f61b

SHA256
3a07aa3f7ee475b7302c0881703cca61029f045c2c045a6c3e39cb9e7b06c288

SHA512
3f3db19f6e3cde07e4a2d56effba40f2a87c010f7f30f0c20187fb4c08d890504f057f2fdcda0bddf304795885bffeb5ca49f3ffc907069df0cedef669c613dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\[email protected]\install.rdf

Filesize
599B

MD5
e22a265f84ed1223cb6f0163ffd80d3f

SHA1
8cbfdddd85790d146f4ec4d1900612d66f6b4ffc

SHA256
c4bf4f874ccd36c2a7ce8d73355e997bfd832b44c5c88ba4cf7f5b517f0b7a56

SHA512
5aa5d91b00463ca7a9df4a2523e2bfa57a83bc45abb789e7c10dfb765485d449ad7c1e7f31ffdd35f293a3b21891b01134d8231c7e9ad334c644cfc4ef39182c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\gfcbpmbjmjmpckboofheaonccgdkejif\background.html

Filesize
140B

MD5
8a0d497d3cbde400a399904b28bdbe96

SHA1
6be5f7594fba173d38f00f46f558d69323c5d991

SHA256
b36c06e87fade09ba1065e6dcd3880332e96bccc8ac5f07819f57d53800c1337

SHA512
2a4f8e9cf03a6d694fbb6db76f8672334d46e252bc81a807e0eecfaa935d244033b4eea7079894cf09815123ec7f41fcf64246d216cd51af210aff4a204d3a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\gfcbpmbjmjmpckboofheaonccgdkejif\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\gfcbpmbjmjmpckboofheaonccgdkejif\f5j.js

Filesize
6KB

MD5
32438f5a07fd0365917f8fd6e36fc565

SHA1
e0381624b3005128810fef62ef26554603318f97

SHA256
c495ace9323d4c78633b202c1e9f61449b9c0ffff1071f8c977f91ef7a1fd394

SHA512
169f8f278da1692ee3118ea9010f7fc0d69d70ba586487ccc9496a17537591d214c4a60d47b1df298b64e839f7dbe1109297a77b5dcbb753319bc708f0c33d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\gfcbpmbjmjmpckboofheaonccgdkejif\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\gfcbpmbjmjmpckboofheaonccgdkejif\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\k3bvGCq53ykTJpr.dat

Filesize
1KB

MD5
c5c59c3b6228e3c831c52b634ad69f18

SHA1
4ad6e53ba6444133e0332b34eae6d648b4537be8

SHA256
ab03ff5a1a7232daf464b35019574207990bded9fd5f665b751e7c5dd7d23d6d

SHA512
d207a6cf26718145d04c35491cd19035e5171a82d0e79d0a4baf0846242e8e24e31e21cdd1cbe88eb173355205d113a875ec929c817bff1de7b74c546b9ffe81

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\k3bvGCq53ykTJpr.exe

Filesize
777KB

MD5
178c3563cc6574b8b620cef5f769c2d7

SHA1
908c944d462651546db71f404bc579119a0375e1

SHA256
0858fa1973bf0b1a7527e115f62467969dcfef1752162af2433700a591b57813

SHA512
05ef8c3a012f540013839b21eea2aa7b92a336143a685dd344ecde19a232f70764280a875d1c324b20aa5b817c0c4b4ab0acc4de28fc5be8da02d8c58cf9edd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6AA7.tmp\k3bvGCq53ykTJpr.exe

Filesize
777KB

MD5
178c3563cc6574b8b620cef5f769c2d7

SHA1
908c944d462651546db71f404bc579119a0375e1

SHA256
0858fa1973bf0b1a7527e115f62467969dcfef1752162af2433700a591b57813

SHA512
05ef8c3a012f540013839b21eea2aa7b92a336143a685dd344ecde19a232f70764280a875d1c324b20aa5b817c0c4b4ab0acc4de28fc5be8da02d8c58cf9edd0

Download Submit