fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0

Analysis

max time kernel
25s
max time network
66s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe
Size

931KB
MD5

43af56e3078b59d43c752dc5cae6a15e
SHA1

ee5f63aa617f1e829226f0d56ae9a6d133d39b32
SHA256

fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0
SHA512

e40ba0f0efc64c8fb09750daa61face5a9251d36c8a9c5caa7ab039b0fbea6feffd25cd140e56e456f7ffae89e8285bd445e6dbcec09e0abc468a9df8c8f07c2
SSDEEP

24576:h1OYdaODCZ/iWCvu/2sWsJA/jlt+DHhsZ:h1OsxCpYO/dJJDHhsZ

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

nv9xrhyBWKhB8S7.exe

pid process

856 nv9xrhyBWKhB8S7.exe
Loads dropped DLL 1 IoCs

Processes:

fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe

pid process

1724 fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1724	fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe

Drops Chrome extension 3 IoCs

Processes:

nv9xrhyBWKhB8S7.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cijoiahmfmibmicmajlejbaddmnaodhc\2.0\manifest.json	nv9xrhyBWKhB8S7.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cijoiahmfmibmicmajlejbaddmnaodhc\2.0\manifest.json	nv9xrhyBWKhB8S7.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cijoiahmfmibmicmajlejbaddmnaodhc\2.0\manifest.json	nv9xrhyBWKhB8S7.exe

Drops file in System32 directory 4 IoCs

Processes:

nv9xrhyBWKhB8S7.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	nv9xrhyBWKhB8S7.exe
File opened for modification	C:\Windows\System32\GroupPolicy	nv9xrhyBWKhB8S7.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	nv9xrhyBWKhB8S7.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	nv9xrhyBWKhB8S7.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

nv9xrhyBWKhB8S7.exe

pid	process
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe
856	nv9xrhyBWKhB8S7.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

nv9xrhyBWKhB8S7.exe

description	pid	process
Token: SeDebugPrivilege	856	nv9xrhyBWKhB8S7.exe
Token: SeDebugPrivilege	856	nv9xrhyBWKhB8S7.exe
Token: SeDebugPrivilege	856	nv9xrhyBWKhB8S7.exe
Token: SeDebugPrivilege	856	nv9xrhyBWKhB8S7.exe
Token: SeDebugPrivilege	856	nv9xrhyBWKhB8S7.exe
Token: SeDebugPrivilege	856	nv9xrhyBWKhB8S7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe

description	pid	process	target process
PID 1724 wrote to memory of 856	1724	fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe	nv9xrhyBWKhB8S7.exe
PID 1724 wrote to memory of 856	1724	fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe	nv9xrhyBWKhB8S7.exe
PID 1724 wrote to memory of 856	1724	fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe	nv9xrhyBWKhB8S7.exe
PID 1724 wrote to memory of 856	1724	fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe	nv9xrhyBWKhB8S7.exe

C:\Users\Admin\AppData\Local\Temp\fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe
"C:\Users\Admin\AppData\Local\Temp\fa25e466edc374b38f5e70fcb7060d33a7e2a464b0e6ab67cbb0e2bb6fc4f2d0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\nv9xrhyBWKhB8S7.exe
.\nv9xrhyBWKhB8S7.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
1a7412986aeeafdebef387b8709bc891

SHA1
1f2173071403a6c589b80332de3a80b53fbf3b3c

SHA256
07b8a5c470e23e52c1af67b1d23a44c983654af258ae7159c9f30d0abf1f0e06

SHA512
7ce98bc10b564c72bfbd19344af28581ec537fd5fc85bcc77cc7a6130bc31bcfcddcbea933b59e765a6ca65e4c592346d2cc16703919d3f5125ee14243ae7802

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
1837d0ccef2369d8b9b6e093d2413235

SHA1
190d490ae5ad84508b2b6c8d5fcf9ae4217e73c5

SHA256
3eb0475fbf97f7f9ceb789fedd9f96a1040a2d844e9259a3fba423a153644fa9

SHA512
6e8fd26576f642ffe170534733d43e559984ae6691a17275acf5c5dc5597e492f365f94552bf7f2e564bde97179a445606304d8053cdf4b90fc6ae7eb38d7f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\[email protected]\install.rdf

Filesize
593B

MD5
4c2ac19018260ea88b48f52654a333f2

SHA1
d41dcd06d1b72e1a2edeada1f9f77d4d8eb4bc6c

SHA256
9c9e3482a0beabbfe4f87df0e26a9bd1b9bced4dc9fdc79f254741bd214f1ce7

SHA512
ee0c1f67f1d44391b561c925723a5dcd72f3b53a282d8428571492eae91e52979e639a8b1a7f5cd518aa2681759e9166a4567d0e7ebe4ac4637a067ac51f017b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\cijoiahmfmibmicmajlejbaddmnaodhc\background.html

Filesize
142B

MD5
204d377abd5eb4df6810463885359330

SHA1
ff1343cb6c4524c4f309c38955c79ae705d9e6e2

SHA256
aaa67e7e4cc5a6518de68247006977b71061d94318dbad3d168e02d34ed0c3fc

SHA512
11ec7295fba10e72eaad63e660591ca5466b0cc280012a0fe6af0d764f0693132cf663527c795dff52032237b74dfab99377d83b5dd091e2976d725e7a425d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\cijoiahmfmibmicmajlejbaddmnaodhc\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\cijoiahmfmibmicmajlejbaddmnaodhc\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\cijoiahmfmibmicmajlejbaddmnaodhc\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\cijoiahmfmibmicmajlejbaddmnaodhc\yhMJF.js

Filesize
6KB

MD5
8e7d26b6ed4c5457ab2b8f4531c5de2f

SHA1
bb491ca7f763972123ed17ab135aa7a952db6c71

SHA256
d3fd4b26133119b57a7cb41995205fa5c6a964b2560632e079c86dc3264dde48

SHA512
1552001aa5653744369c189538db399768563b326d404487f3592d23a3689130a3ff8b94a2000a3cf000001bc067e6fc58b179a1229b96253a9373ebf04ab03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\nv9xrhyBWKhB8S7.dat

Filesize
1KB

MD5
85a4676e5851d3510fd8bab85cedc58b

SHA1
491ab71a491d73ef207edd6b7db9ff14a1e1be2f

SHA256
011a61af76889b60fbb21e91d0f96f8668b3a2d615380d7be5816d127bc6708a

SHA512
6f16eb0c7735eb63980906c2ba02b10e6d5549a86f022e92f802d3db19b2375a2dfc1cf71593888f77bfc716e44f5bc7a73cf3fb99f406936e57e4bcb608032f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\nv9xrhyBWKhB8S7.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF825.tmp\nv9xrhyBWKhB8S7.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/856-56-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download