Analysis
-
max time kernel
35s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:41
Static task
static1
Behavioral task
behavioral1
Sample
f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe
Resource
win10v2004-20221111-en
General
-
Target
f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe
-
Size
2.5MB
-
MD5
1131a2fdfeda91ee25048ba21fa72a8f
-
SHA1
e9effdaad0c33019f5772bb9747339d543dd79e1
-
SHA256
f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0
-
SHA512
a1b88798117ac9953d5a0360f48b3cfb9a83269a96d03e1578bec3b9a0e4ddc3ec04e286a6a5f3bac2cf66a79ae324ca33b29db4420a7340a05c8c2d95e3c2df
-
SSDEEP
49152:h1OsSjtPNg3MaK+715e2Yl8Wd7dZcRGzPbXO2mg6P1Ql5PPLKMRnUDJ:h1OZjVNI71i86pZbz55PPLKMRU9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Qy1IAuIr2OHFR6x.exepid process 1560 Qy1IAuIr2OHFR6x.exe -
Loads dropped DLL 4 IoCs
Processes:
f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exeQy1IAuIr2OHFR6x.exeregsvr32.exeregsvr32.exepid process 1348 f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe 1560 Qy1IAuIr2OHFR6x.exe 780 regsvr32.exe 1928 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
Qy1IAuIr2OHFR6x.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjcpdmenknendcmienjeldihndhbgdhb\5.2\manifest.json Qy1IAuIr2OHFR6x.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjcpdmenknendcmienjeldihndhbgdhb\5.2\manifest.json Qy1IAuIr2OHFR6x.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjcpdmenknendcmienjeldihndhbgdhb\5.2\manifest.json Qy1IAuIr2OHFR6x.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
Qy1IAuIr2OHFR6x.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} Qy1IAuIr2OHFR6x.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects Qy1IAuIr2OHFR6x.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} Qy1IAuIr2OHFR6x.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} Qy1IAuIr2OHFR6x.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ Qy1IAuIr2OHFR6x.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
Qy1IAuIr2OHFR6x.exedescription ioc process File created C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.tlb Qy1IAuIr2OHFR6x.exe File opened for modification C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.tlb Qy1IAuIr2OHFR6x.exe File created C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.dat Qy1IAuIr2OHFR6x.exe File opened for modification C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.dat Qy1IAuIr2OHFR6x.exe File created C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dll Qy1IAuIr2OHFR6x.exe File opened for modification C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dll Qy1IAuIr2OHFR6x.exe File created C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.dll Qy1IAuIr2OHFR6x.exe File opened for modification C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.dll Qy1IAuIr2OHFR6x.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Qy1IAuIr2OHFR6x.exepid process 1560 Qy1IAuIr2OHFR6x.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exeQy1IAuIr2OHFR6x.exeregsvr32.exedescription pid process target process PID 1348 wrote to memory of 1560 1348 f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe Qy1IAuIr2OHFR6x.exe PID 1348 wrote to memory of 1560 1348 f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe Qy1IAuIr2OHFR6x.exe PID 1348 wrote to memory of 1560 1348 f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe Qy1IAuIr2OHFR6x.exe PID 1348 wrote to memory of 1560 1348 f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe Qy1IAuIr2OHFR6x.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 1560 wrote to memory of 780 1560 Qy1IAuIr2OHFR6x.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe PID 780 wrote to memory of 1928 780 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe"C:\Users\Admin\AppData\Local\Temp\f951dc3febbf10d36c2e6849a55e8f6c11d006e5b1315ceb8c07e1ce61b814e0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\Qy1IAuIr2OHFR6x.exe.\Qy1IAuIr2OHFR6x.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.datFilesize
6KB
MD572091b41adb6d1493bb29940b3e0fcf4
SHA14256a618df96a483a2076b9080a82bdf71118bb3
SHA2566289d8d927eaa5b3eccf5b19512b43fa11646659d54b64ad1e8a87890e250845
SHA512fb9a94e6c0129be51cb28ecf76b012a994e0c56cfe1e6b674e0997687ebd09476dbb0f2d26c0500545a202f0360fc07bcd024d810dbf3202ee84c513bbcca49c
-
C:\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\KCX8acZmRivCRg.dllFilesize
741KB
MD502955857b45fa9ddd4229b9d67f65d93
SHA1a5fe5c71d62bd9648ab25660d7cae6eff98af3ed
SHA256839e59c1dd9fa6ce4ed8b4b964b32a3afdd5b6b621580c47cdad754868abe753
SHA5120b0c6a7754abead8aec777a1ee4330f4c5ee90aebde30266e6ad93f356f91abbe4a2bc3fdc924556edb82c3b4bd0f97191e72d6039bed14975d5e5b940af3261
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\KCX8acZmRivCRg.tlbFilesize
3KB
MD575846c93e1f5b9d77fcc4520a65b4936
SHA1f4631b5f768bfa33063a96c7a0da478c1fb28791
SHA256c6843974e37a7eb67c2e6550cec7ffd63645d80f4bd9613430e5824b4604b08b
SHA512a51876207191e351f955e614be727f9b0141cce69d46f7bbf141a632306fe277de3372848c5b707da525d22bafca044b0a73c544a2a670d4056d33f37f7b328c
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\KCX8acZmRivCRg.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\[email protected]\chrome.manifestFilesize
35B
MD58c483d6676abeb5c0e2ba9fe3d011c5b
SHA1fb9d3f0bd9b96ff0aebc28babe57106b02dea855
SHA256eafada1bba6d247821c8120edfad0ed677681a397c8a922ea3e03c0f6a65b7f3
SHA512c0b55d32b10d625b3816611545e056421912530f189cb33edb14b79d7ea7174a45699c228f751e11cc3a461d09408f05a0f72032f5ab61423f062c9cd71e7b97
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\[email protected]\content\bg.jsFilesize
7KB
MD581482a770b2b2915994337205bb631cd
SHA1017a1ed3365391890f9114aa1d8fb39f91835e6b
SHA25683d438245f704bd134369e5219e0ee66c4b834c36e3ef857d666398c45d75a91
SHA51224402a3d4c3ce4f7e5497c198bfb7dbaecd5621415ce2dc8bab36290e4a29e3423d326d6038973910bfc74b61a9d826b7553e4d858b02447c4978bdf4707e9af
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\[email protected]\install.rdfFilesize
601B
MD50f02653d5227713a9d1bf0ef35defdf8
SHA1d0a6e507ec48371ee41b0e60e613249447dc5a30
SHA2561fbb091852f7647fe95ffdaabf603355069bcb2f772ba808df1b1de095590032
SHA5120780d1d2deda4a659ecaa096de4903e75632ff6a3a98b5d93e03b5eb81647057de85cadbae6c36e47a651bff5f63c62abe1c906706b540b308e0798c3933bb6b
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\Qy1IAuIr2OHFR6x.datFilesize
6KB
MD572091b41adb6d1493bb29940b3e0fcf4
SHA14256a618df96a483a2076b9080a82bdf71118bb3
SHA2566289d8d927eaa5b3eccf5b19512b43fa11646659d54b64ad1e8a87890e250845
SHA512fb9a94e6c0129be51cb28ecf76b012a994e0c56cfe1e6b674e0997687ebd09476dbb0f2d26c0500545a202f0360fc07bcd024d810dbf3202ee84c513bbcca49c
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\Qy1IAuIr2OHFR6x.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\Qy1IAuIr2OHFR6x.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\pjcpdmenknendcmienjeldihndhbgdhb\background.htmlFilesize
147B
MD5926408eb8afc68447f966300cebb456f
SHA184fc88406904ed43ae88ecf8a2d2955dc23f0fa8
SHA256cfd61e54418704909b7244dd2d976f3acacafd3f4039ee080360f3297063d669
SHA5126d8052e7624e96b9834f4cd5abd4e5f7cc49059db04d15bd2ef4c9554c8adf97699dadccdfa50c64a32a4de1303dd878150415dca652998274fa999c5253b269
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\pjcpdmenknendcmienjeldihndhbgdhb\cUedQuoOxQ.jsFilesize
5KB
MD54b33b8bfad64fde2af987431869eb2fd
SHA10b6cf814ade0701cc02720ba1aa3e9f4b5a16fe3
SHA256a7eba6bfa1fb3797f4920ac5c5fc2a069526708c7f34e37c990897f0a1cc5455
SHA51296f66341d82b84f6ee1d645c5262949ce0da8a625369cafee596cad0b0689ca8d2dde52666b4247e76cd32fb4ce7979dd0e309b48dbd790a003c64f399b11665
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\pjcpdmenknendcmienjeldihndhbgdhb\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\pjcpdmenknendcmienjeldihndhbgdhb\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\pjcpdmenknendcmienjeldihndhbgdhb\manifest.jsonFilesize
501B
MD59d9d74bfa8e9ace025b834b96419d05e
SHA1f5e56a100b0208b88335859cec692d867ffb572b
SHA256a54dc66b61256c08f2bf60f507673814d263effe532fd8e6e1e1d662eca1d265
SHA5124c8b216a781da9d366d5ea49e66dda6313c1f12947e59119782d14fe07ffa2db9de5b4e818f6e58088dd90f167ac8168796887676e0eacf7a86d2c9f7c3c1512
-
\Program Files (x86)\PriceLess\KCX8acZmRivCRg.dllFilesize
741KB
MD502955857b45fa9ddd4229b9d67f65d93
SHA1a5fe5c71d62bd9648ab25660d7cae6eff98af3ed
SHA256839e59c1dd9fa6ce4ed8b4b964b32a3afdd5b6b621580c47cdad754868abe753
SHA5120b0c6a7754abead8aec777a1ee4330f4c5ee90aebde30266e6ad93f356f91abbe4a2bc3fdc924556edb82c3b4bd0f97191e72d6039bed14975d5e5b940af3261
-
\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Program Files (x86)\PriceLess\KCX8acZmRivCRg.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Users\Admin\AppData\Local\Temp\7zS7C13.tmp\Qy1IAuIr2OHFR6x.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
memory/780-73-0x0000000000000000-mapping.dmp
-
memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmpFilesize
8KB
-
memory/1560-56-0x0000000000000000-mapping.dmp
-
memory/1928-77-0x0000000000000000-mapping.dmp
-
memory/1928-78-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmpFilesize
8KB