Analysis

  • max time kernel
    43s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 11:49

General

  • Target

    71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe

  • Size

    2.1MB

  • MD5

    54413ea3aeea72a4068780be6050c057

  • SHA1

    fdd09a841c9463d2b8256f9b75a6d98a3c3ca358

  • SHA256

    71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed

  • SHA512

    b2b262da12698695fb1103230a876da8d091150aee20e8d7434fe28cdb453689d066ae0ba8e1e00e3b82b3eb5bbe8dc23cfd0d0ce6457bb6e848ff5a692aa0ec

  • SSDEEP

    49152:h1Os4l9RJLu6vcW6hGkaVR7QSiN/tObJmZcqYUuRTk:h1OnrVOhGRkSixtKDi

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe
    "C:\Users\Admin\AppData\Local\Temp\71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\UYjzHNyS0ZeOUB4.exe
      .\UYjzHNyS0ZeOUB4.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.dat

    Filesize

    6KB

    MD5

    6524bfd35d7889f751b1432068fff884

    SHA1

    d2dad1575091b6b7a4d142e0e75ae79694405ff9

    SHA256

    c3fb7a0613639eb208934baa1a3badf91ac9bbe7611ac96cbcafd7aedcf219ea

    SHA512

    d237eb2f968518e9260790ea9243d8eeac57877e83a0cdb03af13abcb0b30883ab9d056a23aab02f6d05bef3cd2e59cf4fcd80ca6120c40a7a5adf87d3293b81

  • C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    a977213dced98e03a11cce0c6638e75f

    SHA1

    bf9639c12a7d343ffd28179a69baa0638f6c8c2f

    SHA256

    50d7fddf5cf74d5beddfcd5c188210a25f2ce57ad6e79961458bde42909c3bf9

    SHA512

    f02afe50014eb44635e6c9cb76ce85fb0251cd4c52472625abb3867aabf47bd011ce247a0fdbf487ebedeae00ff7184ac79b8e3fe74a50a75a4b2f1898259ee2

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    8d9aad045d4fedf01013c0cd9b5c44e7

    SHA1

    a9d9df63fcb7abee5157c66db033594a4c84114b

    SHA256

    5bcb0d529fd6387146af00f2fc6084799ae7887b6263317f7f63e27657b648cd

    SHA512

    491ebd12e3afb6885076c47acc342b0ba03ee2da9d117ec048b33eab46b7d7ca6c019c9895449276280c56b7e8cf8b3dd559586af11c96172dfc669f2376bfba

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\install.rdf

    Filesize

    596B

    MD5

    3531c79091d0c7c33d193d2bed2b649b

    SHA1

    aeda4d465f2aa6112e0dde99c40c59d2531db7fa

    SHA256

    222fffd62b67893883e8acb4928c6754024dbf35931af4a656a6e6e35d9365f2

    SHA512

    ad9a4e399d0967b5a2420e1e14cb5668d72189f605fd3373c3bb2bb426ac7d6fa3b92a5777655d395da1591b9b7d9c4a433a770977b448bb80f2793302415640

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\UYjzHNyS0ZeOUB4.dat

    Filesize

    6KB

    MD5

    6524bfd35d7889f751b1432068fff884

    SHA1

    d2dad1575091b6b7a4d142e0e75ae79694405ff9

    SHA256

    c3fb7a0613639eb208934baa1a3badf91ac9bbe7611ac96cbcafd7aedcf219ea

    SHA512

    d237eb2f968518e9260790ea9243d8eeac57877e83a0cdb03af13abcb0b30883ab9d056a23aab02f6d05bef3cd2e59cf4fcd80ca6120c40a7a5adf87d3293b81

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\UYjzHNyS0ZeOUB4.exe

    Filesize

    622KB

    MD5

    80fb7c6cb182b769448bd45c28fcc963

    SHA1

    454ad8e9ee2267c72222e7f8a902b2c19cfab01d

    SHA256

    9abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3

    SHA512

    224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\UYjzHNyS0ZeOUB4.exe

    Filesize

    622KB

    MD5

    80fb7c6cb182b769448bd45c28fcc963

    SHA1

    454ad8e9ee2267c72222e7f8a902b2c19cfab01d

    SHA256

    9abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3

    SHA512

    224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\fkpjcdihflagapnmhjbmfmhbkoloehnp\background.html

    Filesize

    141B

    MD5

    58c104b49f7faf54cd3a013ae221fce6

    SHA1

    c5bd0eaa9c1414ca592ad52e88cba975f1ee73b8

    SHA256

    1c352785044692bc6c21b497b9c143374382b6edaee9ce6ec981ff101efd1bb8

    SHA512

    880751472b87841d101c4e2f8a26809e031baa81eacc0bb740581680e9d8ac09b97cef4a13dfde7399204c9d6fe4e7aad26977ab7d73659c7d9aee10d660cfab

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\fkpjcdihflagapnmhjbmfmhbkoloehnp\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\fkpjcdihflagapnmhjbmfmhbkoloehnp\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\fkpjcdihflagapnmhjbmfmhbkoloehnp\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\fkpjcdihflagapnmhjbmfmhbkoloehnp\ro89.js

    Filesize

    5KB

    MD5

    b43a42f17199103864064c4d8f11d35a

    SHA1

    fdfd2604f3984b6118d2ce0c72cf83bed2cfa822

    SHA256

    594fc56ab3793cad2da482e0e13cd4d5cdb346021bd246edd67ab5084273df75

    SHA512

    7c335bd8590112254a97d810aedd545cfb37d6624f4b09478df641f26ca7778aa6b21cae1d0d826f43e7a8802a65114e67a30cd76ce113da1ea6be438f3824b1

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\ugmbMdEOhIUeVX.dll

    Filesize

    621KB

    MD5

    021d6ecac6ffca37cd098212eb99c22e

    SHA1

    e662d4f6bcee66df291ee638349bd75d5468e834

    SHA256

    f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50

    SHA512

    8fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\ugmbMdEOhIUeVX.tlb

    Filesize

    3KB

    MD5

    38dcedc06ce882652b73038799f369c1

    SHA1

    09985c74e62920963791808be0765222d2a517d3

    SHA256

    37996a9f383f824002a73026332578b823bacad0a736f2f4c25401f6e2da307c

    SHA512

    78b7ab8fc102a0f874d24bb40e7b399befe3eb8788c08b059487770dd83a390daf0011c34d6cd29dd78e3436bfd6587fff2f50bde0c3bed49e6ffe27ef0b4c16

  • C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\ugmbMdEOhIUeVX.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • \Program Files (x86)\GoSave\ugmbMdEOhIUeVX.dll

    Filesize

    621KB

    MD5

    021d6ecac6ffca37cd098212eb99c22e

    SHA1

    e662d4f6bcee66df291ee638349bd75d5468e834

    SHA256

    f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50

    SHA512

    8fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f

  • \Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • \Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • \Users\Admin\AppData\Local\Temp\7zSBD28.tmp\UYjzHNyS0ZeOUB4.exe

    Filesize

    622KB

    MD5

    80fb7c6cb182b769448bd45c28fcc963

    SHA1

    454ad8e9ee2267c72222e7f8a902b2c19cfab01d

    SHA256

    9abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3

    SHA512

    224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14

  • memory/1112-73-0x0000000000000000-mapping.dmp

  • memory/1296-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

    Filesize

    8KB

  • memory/1340-56-0x0000000000000000-mapping.dmp

  • memory/1700-77-0x0000000000000000-mapping.dmp

  • memory/1700-78-0x000007FEFBA21000-0x000007FEFBA23000-memory.dmp

    Filesize

    8KB