fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe
Size

920KB
MD5

3975bf6f7cf5556607f48b80c89be3de
SHA1

13410e71cd80496a4c2942bacebaa8b89034b80d
SHA256

fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b
SHA512

963a9001f0d3d80697f7d66b18c8af19c7968d58191b863fb301f78d18826e7237743fdb8ca7651631608dc4d0ce938c2c8df9caac5ac0eb0fea44ebb08ee67a
SSDEEP

24576:h1OYdaOLMtdHAqcdDVhYwiei7+EpFAh/kKn:h1OsyPHVmVhYwiLtKkKn

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

fDzuATm530to4eX.exe

pid process

1516 fDzuATm530to4eX.exe
Loads dropped DLL 1 IoCs

Processes:

fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe

pid process

2020 fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2020	fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe

Drops Chrome extension 3 IoCs

Processes:

fDzuATm530to4eX.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdlfklbjjppedaofidacniaomkigihe\2.0\manifest.json	fDzuATm530to4eX.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdlfklbjjppedaofidacniaomkigihe\2.0\manifest.json	fDzuATm530to4eX.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdlfklbjjppedaofidacniaomkigihe\2.0\manifest.json	fDzuATm530to4eX.exe

Drops file in System32 directory 4 IoCs

Processes:

fDzuATm530to4eX.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	fDzuATm530to4eX.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	fDzuATm530to4eX.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	fDzuATm530to4eX.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	fDzuATm530to4eX.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

fDzuATm530to4eX.exe

pid	process
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe
1516	fDzuATm530to4eX.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fDzuATm530to4eX.exe

description	pid	process
Token: SeDebugPrivilege	1516	fDzuATm530to4eX.exe
Token: SeDebugPrivilege	1516	fDzuATm530to4eX.exe
Token: SeDebugPrivilege	1516	fDzuATm530to4eX.exe
Token: SeDebugPrivilege	1516	fDzuATm530to4eX.exe
Token: SeDebugPrivilege	1516	fDzuATm530to4eX.exe
Token: SeDebugPrivilege	1516	fDzuATm530to4eX.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe

description	pid	process	target process
PID 2020 wrote to memory of 1516	2020	fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe	fDzuATm530to4eX.exe
PID 2020 wrote to memory of 1516	2020	fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe	fDzuATm530to4eX.exe
PID 2020 wrote to memory of 1516	2020	fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe	fDzuATm530to4eX.exe
PID 2020 wrote to memory of 1516	2020	fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe	fDzuATm530to4eX.exe

C:\Users\Admin\AppData\Local\Temp\fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe
"C:\Users\Admin\AppData\Local\Temp\fbca38385fe2bcac92a167f623a3ff3b181e1089fbb9359c4f4fd26dc987b42b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\fDzuATm530to4eX.exe
.\fDzuATm530to4eX.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\fDzuATm530to4eX.dat

Filesize
1KB

MD5
0f91a3e89a9ff4f44a862132f2857483

SHA1
4e1eb2fbe99f47442621bba2a62fb374cb203cf5

SHA256
a0b22b16301938b595285ee58f8ed4f2aae032e12363e4c017b014450c7d8b01

SHA512
2ce436308c041d48b79a30d1d04bff5120d11ce91f550bc8a2dc5a1de7dfa5d118acbf224ad8f43305adf85be413aa6020763f1eab714eeef6dfb6da608d54bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\fDzuATm530to4eX.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\pbdlfklbjjppedaofidacniaomkigihe\XAs6iDibwv.js

Filesize
6KB

MD5
a72091eb724c411791ba9bbdee9638c5

SHA1
84a9f8cfa9df473dbba4bf3aa25813e638015cbc

SHA256
067362e0518d71c136fd5163a2a7855887f0a9d44eb1a08727b4a6290c37bedc

SHA512
1fbdd63b9fdb98c141fdb0cde8298b2c2c424ad294ebed83b95f3b2a724e884ef6960d75c2a229affe8758c061b0c598692131d193ae1cfee3ee8dcfe67e7ae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\pbdlfklbjjppedaofidacniaomkigihe\background.html

Filesize
147B

MD5
06e4125339d6351fd94534a5ce476831

SHA1
c0abc517f6936331d0de1e37bacba9a4978405fc

SHA256
4362eb639fa6ed7a3481e7060218ccccf8c138be69bde18e2839f39ab77d1c68

SHA512
7ced2edc24b20deb67239be080a8d7618486cd4bfff8a4caa7fa4b3bbeff237041d6cc089bb6a794f941ff7402f96916c86610b997c4eac086d78c5e6ca4e688

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\pbdlfklbjjppedaofidacniaomkigihe\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\pbdlfklbjjppedaofidacniaomkigihe\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\pbdlfklbjjppedaofidacniaomkigihe\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
c372ae65fb3030b82c098b48c7fe9342

SHA1
77ff907b4d9fa4632e78832f2d1a9226034a8a17

SHA256
11af8d3471d6f416231e49b718943791eb350767d30e5f487feaa8c323cfe568

SHA512
3b11eae207665dea67f5425ab7987096c312f9ba0e610c9897d85a481d90f1538d22d7f40a2aed6591c89a9b4e83a23bb8f5920f98c9678defdca2239e8d7bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
f03316c4a3df46915f33017b249f163b

SHA1
c59abe41b38036915400e77b8876cd72ae029d7f

SHA256
c259d735bb965ae9f167844f41cb22e486482671cfe81f10304b4edf86dcfa3e

SHA512
cb3bc22a8513a173a5287facf95a9a2240099c08ba1720f2687e05227b1b29f9999c26aadcfb4c32581f1352fd77c0b8b9a210b470c8def4c3df816ce95913a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\install.rdf

Filesize
596B

MD5
4d4ef339aab60808c4c63b88653c7629

SHA1
4fee01a90a11c9a6744f85bb917e54efb0043cb4

SHA256
18391c156bf321de046f4788f44124836e1766b1fbbad6a382e31bfc2e2fcfe1

SHA512
dd74a249bb779d30bc6c9b9264f164477836c9bb462cd492f7b17abbe0a3c0b5e6f213e72219448e6230cb054fc9574af43bfb45e8794c851cd1d5ce031ffe8b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7946.tmp\fDzuATm530to4eX.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/1516-56-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download