Analysis
-
max time kernel
43s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 11:49
Static task
static1
Behavioral task
behavioral1
Sample
71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe
Resource
win7-20221111-en
General
-
Target
71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe
-
Size
2.1MB
-
MD5
54413ea3aeea72a4068780be6050c057
-
SHA1
fdd09a841c9463d2b8256f9b75a6d98a3c3ca358
-
SHA256
71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed
-
SHA512
b2b262da12698695fb1103230a876da8d091150aee20e8d7434fe28cdb453689d066ae0ba8e1e00e3b82b3eb5bbe8dc23cfd0d0ce6457bb6e848ff5a692aa0ec
-
SSDEEP
49152:h1Os4l9RJLu6vcW6hGkaVR7QSiN/tObJmZcqYUuRTk:h1OnrVOhGRkSixtKDi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
UYjzHNyS0ZeOUB4.exepid process 1340 UYjzHNyS0ZeOUB4.exe -
Loads dropped DLL 4 IoCs
Processes:
71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exeUYjzHNyS0ZeOUB4.exeregsvr32.exeregsvr32.exepid process 1296 71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe 1340 UYjzHNyS0ZeOUB4.exe 1112 regsvr32.exe 1700 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
UYjzHNyS0ZeOUB4.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkpjcdihflagapnmhjbmfmhbkoloehnp\2.0\manifest.json UYjzHNyS0ZeOUB4.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkpjcdihflagapnmhjbmfmhbkoloehnp\2.0\manifest.json UYjzHNyS0ZeOUB4.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkpjcdihflagapnmhjbmfmhbkoloehnp\2.0\manifest.json UYjzHNyS0ZeOUB4.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
UYjzHNyS0ZeOUB4.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} UYjzHNyS0ZeOUB4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ UYjzHNyS0ZeOUB4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} UYjzHNyS0ZeOUB4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} UYjzHNyS0ZeOUB4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects UYjzHNyS0ZeOUB4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
UYjzHNyS0ZeOUB4.exedescription ioc process File created C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.dll UYjzHNyS0ZeOUB4.exe File opened for modification C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.dll UYjzHNyS0ZeOUB4.exe File created C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.tlb UYjzHNyS0ZeOUB4.exe File opened for modification C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.tlb UYjzHNyS0ZeOUB4.exe File created C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.dat UYjzHNyS0ZeOUB4.exe File opened for modification C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.dat UYjzHNyS0ZeOUB4.exe File created C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll UYjzHNyS0ZeOUB4.exe File opened for modification C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll UYjzHNyS0ZeOUB4.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
UYjzHNyS0ZeOUB4.exepid process 1340 UYjzHNyS0ZeOUB4.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exeUYjzHNyS0ZeOUB4.exeregsvr32.exedescription pid process target process PID 1296 wrote to memory of 1340 1296 71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe UYjzHNyS0ZeOUB4.exe PID 1296 wrote to memory of 1340 1296 71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe UYjzHNyS0ZeOUB4.exe PID 1296 wrote to memory of 1340 1296 71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe UYjzHNyS0ZeOUB4.exe PID 1296 wrote to memory of 1340 1296 71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe UYjzHNyS0ZeOUB4.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1340 wrote to memory of 1112 1340 UYjzHNyS0ZeOUB4.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1700 1112 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe"C:\Users\Admin\AppData\Local\Temp\71b9632fc3a60654a92365e17a2db16600d9a5e61c37beadc7fc2841051154ed.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\UYjzHNyS0ZeOUB4.exe.\UYjzHNyS0ZeOUB4.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\ugmbMdEOhIUeVX.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:1700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD56524bfd35d7889f751b1432068fff884
SHA1d2dad1575091b6b7a4d142e0e75ae79694405ff9
SHA256c3fb7a0613639eb208934baa1a3badf91ac9bbe7611ac96cbcafd7aedcf219ea
SHA512d237eb2f968518e9260790ea9243d8eeac57877e83a0cdb03af13abcb0b30883ab9d056a23aab02f6d05bef3cd2e59cf4fcd80ca6120c40a7a5adf87d3293b81
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\chrome.manifest
Filesize35B
MD5a977213dced98e03a11cce0c6638e75f
SHA1bf9639c12a7d343ffd28179a69baa0638f6c8c2f
SHA25650d7fddf5cf74d5beddfcd5c188210a25f2ce57ad6e79961458bde42909c3bf9
SHA512f02afe50014eb44635e6c9cb76ce85fb0251cd4c52472625abb3867aabf47bd011ce247a0fdbf487ebedeae00ff7184ac79b8e3fe74a50a75a4b2f1898259ee2
-
C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\content\bg.js
Filesize7KB
MD58d9aad045d4fedf01013c0cd9b5c44e7
SHA1a9d9df63fcb7abee5157c66db033594a4c84114b
SHA2565bcb0d529fd6387146af00f2fc6084799ae7887b6263317f7f63e27657b648cd
SHA512491ebd12e3afb6885076c47acc342b0ba03ee2da9d117ec048b33eab46b7d7ca6c019c9895449276280c56b7e8cf8b3dd559586af11c96172dfc669f2376bfba
-
C:\Users\Admin\AppData\Local\Temp\7zSBD28.tmp\[email protected]\install.rdf
Filesize596B
MD53531c79091d0c7c33d193d2bed2b649b
SHA1aeda4d465f2aa6112e0dde99c40c59d2531db7fa
SHA256222fffd62b67893883e8acb4928c6754024dbf35931af4a656a6e6e35d9365f2
SHA512ad9a4e399d0967b5a2420e1e14cb5668d72189f605fd3373c3bb2bb426ac7d6fa3b92a5777655d395da1591b9b7d9c4a433a770977b448bb80f2793302415640
-
Filesize
6KB
MD56524bfd35d7889f751b1432068fff884
SHA1d2dad1575091b6b7a4d142e0e75ae79694405ff9
SHA256c3fb7a0613639eb208934baa1a3badf91ac9bbe7611ac96cbcafd7aedcf219ea
SHA512d237eb2f968518e9260790ea9243d8eeac57877e83a0cdb03af13abcb0b30883ab9d056a23aab02f6d05bef3cd2e59cf4fcd80ca6120c40a7a5adf87d3293b81
-
Filesize
622KB
MD580fb7c6cb182b769448bd45c28fcc963
SHA1454ad8e9ee2267c72222e7f8a902b2c19cfab01d
SHA2569abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3
SHA512224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14
-
Filesize
622KB
MD580fb7c6cb182b769448bd45c28fcc963
SHA1454ad8e9ee2267c72222e7f8a902b2c19cfab01d
SHA2569abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3
SHA512224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14
-
Filesize
141B
MD558c104b49f7faf54cd3a013ae221fce6
SHA1c5bd0eaa9c1414ca592ad52e88cba975f1ee73b8
SHA2561c352785044692bc6c21b497b9c143374382b6edaee9ce6ec981ff101efd1bb8
SHA512880751472b87841d101c4e2f8a26809e031baa81eacc0bb740581680e9d8ac09b97cef4a13dfde7399204c9d6fe4e7aad26977ab7d73659c7d9aee10d660cfab
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
Filesize
5KB
MD5b43a42f17199103864064c4d8f11d35a
SHA1fdfd2604f3984b6118d2ce0c72cf83bed2cfa822
SHA256594fc56ab3793cad2da482e0e13cd4d5cdb346021bd246edd67ab5084273df75
SHA5127c335bd8590112254a97d810aedd545cfb37d6624f4b09478df641f26ca7778aa6b21cae1d0d826f43e7a8802a65114e67a30cd76ce113da1ea6be438f3824b1
-
Filesize
621KB
MD5021d6ecac6ffca37cd098212eb99c22e
SHA1e662d4f6bcee66df291ee638349bd75d5468e834
SHA256f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50
SHA5128fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f
-
Filesize
3KB
MD538dcedc06ce882652b73038799f369c1
SHA109985c74e62920963791808be0765222d2a517d3
SHA25637996a9f383f824002a73026332578b823bacad0a736f2f4c25401f6e2da307c
SHA51278b7ab8fc102a0f874d24bb40e7b399befe3eb8788c08b059487770dd83a390daf0011c34d6cd29dd78e3436bfd6587fff2f50bde0c3bed49e6ffe27ef0b4c16
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
621KB
MD5021d6ecac6ffca37cd098212eb99c22e
SHA1e662d4f6bcee66df291ee638349bd75d5468e834
SHA256f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50
SHA5128fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
622KB
MD580fb7c6cb182b769448bd45c28fcc963
SHA1454ad8e9ee2267c72222e7f8a902b2c19cfab01d
SHA2569abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3
SHA512224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14