fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8

Analysis

max time kernel
123s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe
Size

920KB
MD5

002ed86f637bd1b3708a6e96a2b0f416
SHA1

e82749c047a336e1626021e87bebdca5b676fa7c
SHA256

fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8
SHA512

6c92db7215785b1a51ae2e2e769c7f1fab435d68385e01d9d3d2eabf5bb95784bb86f7057936536d93e1b5c3557df7eae49bcfcde95154be46cf64bd3d83e47e
SSDEEP

24576:h1OYdaO4MtdHAqcdDVhYwiei7+EpFAh/kKb:h1Os1PHVmVhYwiLtKkKb

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

HIgP9BpAaiR5xG8.exe

pid process

4656 HIgP9BpAaiR5xG8.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

HIgP9BpAaiR5xG8.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjaapjnhgklaadbdgabnnpdckghfbpc\1.3\manifest.json	HIgP9BpAaiR5xG8.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjaapjnhgklaadbdgabnnpdckghfbpc\1.3\manifest.json	HIgP9BpAaiR5xG8.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjaapjnhgklaadbdgabnnpdckghfbpc\1.3\manifest.json	HIgP9BpAaiR5xG8.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjaapjnhgklaadbdgabnnpdckghfbpc\1.3\manifest.json	HIgP9BpAaiR5xG8.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjaapjnhgklaadbdgabnnpdckghfbpc\1.3\manifest.json	HIgP9BpAaiR5xG8.exe

Drops file in System32 directory 4 IoCs

Processes:

HIgP9BpAaiR5xG8.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	HIgP9BpAaiR5xG8.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	HIgP9BpAaiR5xG8.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	HIgP9BpAaiR5xG8.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	HIgP9BpAaiR5xG8.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

HIgP9BpAaiR5xG8.exe

pid	process
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe
4656	HIgP9BpAaiR5xG8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe

description	pid	process	target process
PID 2128 wrote to memory of 4656	2128	fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe	HIgP9BpAaiR5xG8.exe
PID 2128 wrote to memory of 4656	2128	fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe	HIgP9BpAaiR5xG8.exe
PID 2128 wrote to memory of 4656	2128	fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe	HIgP9BpAaiR5xG8.exe

C:\Users\Admin\AppData\Local\Temp\fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe
"C:\Users\Admin\AppData\Local\Temp\fc2fd87504be93791fef2dab9808b9164b25bbde0ed8f9f2144b4bc2c52b70c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128

C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\HIgP9BpAaiR5xG8.exe
.\HIgP9BpAaiR5xG8.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5060

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\HIgP9BpAaiR5xG8.dat
Filesize
1KB

MD5
30d1132fda261f23deeb7b2dab00b1ff

SHA1
151fe6c86273f8f9bca63b76f48a7574381d38f5

SHA256
1b295d45977c205b1a9da4895e028d4967ac62e9e4d9949e8587f231737cde15

SHA512
ec69bcd66f45763fcb5f3322eba559a76f9e0bdba1a2e11f5b22f7389d4137663d63994a260f09837a719aab28638866fe1a193aebe14063a59391744e63601d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\HIgP9BpAaiR5xG8.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\HIgP9BpAaiR5xG8.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\lmjaapjnhgklaadbdgabnnpdckghfbpc\background.html
Filesize
139B

MD5
2e677709349db412ae473d276b02ad28

SHA1
dfda9bc35cc1daee3e056e13a548ac78576e8113

SHA256
c5e94488658f59fb586895340fdec132c30bea2d498513f3b2822c9ed161b8f1

SHA512
447ab9cbde6148904c615dcb1014c22a51dcae85dd7e5fde8a52bf3999be20e487fe80f713670b276b9c82485df5a2a9a50de5a36822d6931a7e06a92d24aa0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\lmjaapjnhgklaadbdgabnnpdckghfbpc\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\lmjaapjnhgklaadbdgabnnpdckghfbpc\j4.js
Filesize
6KB

MD5
061c313966390d5ffb61b8d7bc450cc5

SHA1
01407e07281b686d961c4cc0bbf6d0b6dfe33ae8

SHA256
f52cfa53b4a84fa4fd57695e4bd34f3754634a36ecda7b58ffc5232e86581c79

SHA512
55c48d6350a7670004acbacdb5317d26975719e21966935c384435894a13e122e624900175fe9678d754a7dac5b5313bb18e3209def986ceaa528229aeaf2d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\lmjaapjnhgklaadbdgabnnpdckghfbpc\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\lmjaapjnhgklaadbdgabnnpdckghfbpc\manifest.json
Filesize
498B

MD5
664e2884e17f23553a19eee317642194

SHA1
a28ccc088d6b6692646150f3e8f111e568723fb4

SHA256
ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

SHA512
b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
975287ac7d56974e48f3595d1e5d0865

SHA1
34cda27711c96c9fb9724f9ce0e58014aaacb205

SHA256
12abde0ad9dc8b41b11fd9c66dc3ceb6d55ae1c8e4b17905645f7be8a281b0d3

SHA512
ae147f1ac5920fa21d96560fc19f1bea7b0eedf025a3a19cedf0814acb07dc4eec20782aa43f4b33dd0d7d5a85c3fe15e8547226311aa00bb41e9113a08071ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
455dbc713d54724483c67382d6d84475

SHA1
7b9110d43c313351dfb30e142de65d21e50c8ad2

SHA256
15affe0bc4f2d814221124e087a6b24e6cb51ef75052e8e3d12392aeef7fa46c

SHA512
5e50b4798e1ca621a503e69f4f28d3097343eeb8a00f05b4bc3ba55cff724941e334b3fe426b90bae29df6057639a4e099a4812717aaea7fd6c1ee969220c222

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAB96.tmp\[email protected]\install.rdf
Filesize
591B

MD5
03c4c0a9a4e9bb2e14d527873baca85d

SHA1
d566409b50063b9f3e6425d69d2f6230d9b619a9

SHA256
d8bb8667a68ebca74e93af9dcd8901635566dc79f41758e65d51aceba74f380a

SHA512
b9836200ffb422de22ba2425abf89df4eaa808653bdc3cd3e9a015ae2e76cc62fdd95b6237871f5c0c8c4af7d51170e680b57bf4dcde75663055e10865737bcd

Download Submit
memory/4656-135-0x0000000000000000-mapping.dmp

Download