Analysis
-
max time kernel
166s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe
Resource
win7-20220812-en
General
-
Target
fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe
-
Size
920KB
-
MD5
5baa38225ed95c125fc8f8982b08ab36
-
SHA1
487573192aaad51d5fa5e236f001f4c313648a6b
-
SHA256
fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e
-
SHA512
ed546960d8ecdf911d31c4826c84fd6936e938654ff515fbfd46b76dc3ebf1e906ac2da3654b1341c7d34f7e4f2627127850965c2202ad44b6b666aa014dafcf
-
SSDEEP
24576:h1OYdaOHMtdHAqcdDVhYwiei7+EpFAh/kK0:h1OsqPHVmVhYwiLtKkK0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
6Ku7aJCCxI9pFwO.exepid process 2252 6Ku7aJCCxI9pFwO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
6Ku7aJCCxI9pFwO.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cldfiboclldkfeaphdlkhocdifpkbjem\2.0\manifest.json 6Ku7aJCCxI9pFwO.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cldfiboclldkfeaphdlkhocdifpkbjem\2.0\manifest.json 6Ku7aJCCxI9pFwO.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cldfiboclldkfeaphdlkhocdifpkbjem\2.0\manifest.json 6Ku7aJCCxI9pFwO.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cldfiboclldkfeaphdlkhocdifpkbjem\2.0\manifest.json 6Ku7aJCCxI9pFwO.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cldfiboclldkfeaphdlkhocdifpkbjem\2.0\manifest.json 6Ku7aJCCxI9pFwO.exe -
Drops file in System32 directory 4 IoCs
Processes:
6Ku7aJCCxI9pFwO.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 6Ku7aJCCxI9pFwO.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 6Ku7aJCCxI9pFwO.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 6Ku7aJCCxI9pFwO.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 6Ku7aJCCxI9pFwO.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
6Ku7aJCCxI9pFwO.exepid process 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe 2252 6Ku7aJCCxI9pFwO.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
6Ku7aJCCxI9pFwO.exedescription pid process Token: SeDebugPrivilege 2252 6Ku7aJCCxI9pFwO.exe Token: SeDebugPrivilege 2252 6Ku7aJCCxI9pFwO.exe Token: SeDebugPrivilege 2252 6Ku7aJCCxI9pFwO.exe Token: SeDebugPrivilege 2252 6Ku7aJCCxI9pFwO.exe Token: SeDebugPrivilege 2252 6Ku7aJCCxI9pFwO.exe Token: SeDebugPrivilege 2252 6Ku7aJCCxI9pFwO.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exedescription pid process target process PID 1936 wrote to memory of 2252 1936 fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe 6Ku7aJCCxI9pFwO.exe PID 1936 wrote to memory of 2252 1936 fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe 6Ku7aJCCxI9pFwO.exe PID 1936 wrote to memory of 2252 1936 fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe 6Ku7aJCCxI9pFwO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe"C:\Users\Admin\AppData\Local\Temp\fb990f8adb033024bbf6d276f967e9c3d9ece78cfb3eb96b950a2076cd8d537e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\7zSB839.tmp\6Ku7aJCCxI9pFwO.exe.\6Ku7aJCCxI9pFwO.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58dfaec210449ee7f5f9299bc19a1705f
SHA133cd73d86a28c712ff2c54e803433c7b6227071a
SHA2563dcc62c5e7cba793379695f505d17e1c48e46bddb11db57ae63e21ac5ac0c7f1
SHA51238f2cc387b7c40e4d5db0c101a63ca322eadd117a0e3883331851141f688b99ca190dfc790ca1a913a264a357dbb4386afd128996d66b3cbed15f3c855982f41
-
Filesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
Filesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSB839.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSB839.tmp\[email protected]\chrome.manifest
Filesize35B
MD532e2444b9183b8c130e1a088a11823d0
SHA17486a31bf52d42efea5337a94803390cb7fa99ed
SHA256e538994b0bf2c720d485db13258fa6718729b8bb16935c09051741c4f4a49775
SHA512e0d30840c0ad23fea345ff6e1bb0ecb330e03ccf23017e19aee208a59b1659b8b72e72bef825ec74d2f3be18495e1574ecbc27d80a31bc4568b9dab5355e87b2
-
C:\Users\Admin\AppData\Local\Temp\7zSB839.tmp\[email protected]\content\bg.js
Filesize8KB
MD538c80d2c10a4fae5da3afe105ef3202f
SHA18a64535bde5e63156ad70fdd8497e9c857f5d5cd
SHA25632b31496b753460aa00b2a0bbf36081367634db2913d5b1e75a4f2a5cf22a3b0
SHA512161d0ba56db314b187bb975c230b0f9efb6871f8427a2e8860434705f3181ae3c80587b736b1e6339b6289f5cda99ea71eb30af8620e7b5e41aa0c5aca693ab5
-
C:\Users\Admin\AppData\Local\Temp\7zSB839.tmp\[email protected]\install.rdf
Filesize591B
MD577c9f7f7b1df2786de10134461b7f3c0
SHA1617de1ce4cd141b70a5d37df4059b37bc200b2c4
SHA256459e6bd34b70d046eae83197a9cde1a5cdf6e1a63862301953f7fa4c5a978e6e
SHA512e7fed8a0b2050d6fca9a905029b032d2fad8d01e5bd901f974a1e1d046377be8f5f0d8ed47094aa7b15aa0a82dce49806fe3eab090ba0f9b19b4dbb91122c6b8
-
Filesize
6KB
MD56a40fb381bad0d6a606a9527918bd301
SHA1a29bab337240302f6011f199f581997953caef79
SHA256e6f3c7e345c98288b6a9e308822f7b524b5f47683f8d0defc8d29dcfef64c437
SHA5122c90b1418cd5a3fbaff678412374fae93a33ff493c4799a79dad05eecc4d1c4603fd4f85e32e0dad874d5b2bc947e3b6e7d2bfd63f199107b61ed194fb2d2bc0
-
Filesize
143B
MD5e3e9846365dc8d7b9fb9b7ba42e33a71
SHA10ad8f9a2af5f4a2745ea35b38ceacc6597f63dd4
SHA256097a280b0d8e3b16395a229c46c8c2df5c4bcbc1a5a595cf249d271663479ef2
SHA51240a0c8fccfeb1299070c751eedead793ec1821a2d8ba85b85063275951e31ec6f7b8d7fdcd855d823e01c52cd76e8c7454ab399688623ad4274bb65032ece396
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a