fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6

General

Target

fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe
Size

920KB
MD5

59ba24ead4e0c7f47c2a2efda2cabd3b
SHA1

097c98a4e7254e0532ae29650508427def35f29b
SHA256

fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6
SHA512

3fad793580ef05b10af48382fab911aa6685fe65016ccf7f85ec27b9af4808bb2d9d8e9027d38ad08ea39759fac922c77760c9941006e1f9024ea49058c821d3
SSDEEP

24576:h1OYdaOmCZ/iWCvu/2sWsJA/jlt+DHhsu:h1OsYCpYO/dJJDHhsu

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

YCxlmrXmaAKujro.exe

pid process

820 YCxlmrXmaAKujro.exe
Loads dropped DLL 1 IoCs

Processes:

fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe

pid process

2032 fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
820	YCxlmrXmaAKujro.exe

pid	process
2032	fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe

Drops Chrome extension 3 IoCs

Processes:

YCxlmrXmaAKujro.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\copciehbkikbfnppdndaegnlgkelahfe\218\manifest.json	YCxlmrXmaAKujro.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\copciehbkikbfnppdndaegnlgkelahfe\218\manifest.json	YCxlmrXmaAKujro.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\copciehbkikbfnppdndaegnlgkelahfe\218\manifest.json	YCxlmrXmaAKujro.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

YCxlmrXmaAKujro.exe

pid process

820 YCxlmrXmaAKujro.exe

pid	process
820	YCxlmrXmaAKujro.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe

description	pid	process	target process
PID 2032 wrote to memory of 820	2032	fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe	YCxlmrXmaAKujro.exe
PID 2032 wrote to memory of 820	2032	fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe	YCxlmrXmaAKujro.exe
PID 2032 wrote to memory of 820	2032	fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe	YCxlmrXmaAKujro.exe
PID 2032 wrote to memory of 820	2032	fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe	YCxlmrXmaAKujro.exe

C:\Users\Admin\AppData\Local\Temp\fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe
"C:\Users\Admin\AppData\Local\Temp\fab0edaac2ae4004274c6c8b840974a34dfffc80b0ef5c8fdf2b4419d66d39d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\YCxlmrXmaAKujro.exe
.\YCxlmrXmaAKujro.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\YCxlmrXmaAKujro.dat

Filesize
1KB

MD5
612112614e1914f6d43737a4d6cfc2aa

SHA1
ef0df7fce2dcf20272dd30199854f8e2687af8d2

SHA256
af131b4339a493a6e979ced50122805db399730e03973f021aa91491da9055d2

SHA512
2d11bad7bc85b6c2b3986c79e5ae8b9042d7969c7a834b6ef9dab2010bfad881f5d66c4020c96502a6f9c1cc066e2459c6492803d48aad0abaa275e2c80db764

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\YCxlmrXmaAKujro.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\copciehbkikbfnppdndaegnlgkelahfe\background.html

Filesize
139B

MD5
7b1ff7bea4fa50ed4336c737dea5b721

SHA1
219dc5abde05e72b899dd132ea57147a82e44ef0

SHA256
eb0bce65b1775096ae46a264492d8bd11cf3428cc46422c00ebecd5b33a87114

SHA512
9c07ebc50983814df88ae7bd116a421459f5cf79f23a50fa9bfc5c533e7444faf75e36e4388935d0983d610828a1deb2f6f75a9181354b5460dc77397b78a48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\copciehbkikbfnppdndaegnlgkelahfe\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\copciehbkikbfnppdndaegnlgkelahfe\l1.js

Filesize
7KB

MD5
13ca4daa96e7c2f1425705146294600f

SHA1
c8dd599a72e592bac2037ec2bb24e4c37e73c25b

SHA256
7e95f433aeeddef34cd9a5ecac6c636878b90f10cb338426a9ab51ed51da0031

SHA512
38510802969870ada703b2a3e7ff2af9948b0bae0acc700e281c7efb9ca2886b5bb443ddfe67699a32524df9961c5bcaf87f78aec98dd624eb01f4a61f8291fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\copciehbkikbfnppdndaegnlgkelahfe\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\copciehbkikbfnppdndaegnlgkelahfe\manifest.json

Filesize
596B

MD5
443fb4ebe4aa2788e8180234303a9638

SHA1
877b89b884f9ae9360f7d5862ddd3f466b3242a9

SHA256
be584a4935b01fd140f2fa6acb2fe9fc8647cbed3ff50a80e12fc923ba470ec3

SHA512
2fb97c2e00dc129365cdfe368bf56feeb870214422be0622df7844316a700b8b5a25ffb689a304a02a5fb0e2e04c9a288b8f3ac4305ba3c6010fe4a72e436449

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFCA.tmp\YCxlmrXmaAKujro.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/820-56-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing