f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576

Analysis

max time kernel
13s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe
Size

920KB
MD5

cb37d59920665e390775652551f99e82
SHA1

78e0faedeac32d30d1cd91b9cd62b4192eaa2b01
SHA256

f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576
SHA512

dcd01c35974508386a3d784a6338c3693450a98c2c7e7938da2c8f7c0812acf394d498693821fde6f74ecdc8e6e013a4200bcfbb75cba009872be786563388b0
SSDEEP

24576:h1OYdaOHMtdHAqcdDVhYwiei7+EpFAh/kKv:h1OsGPHVmVhYwiLtKkKv

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

tTtgjD5SFzFnlGl.exe

pid process

1648 tTtgjD5SFzFnlGl.exe
Loads dropped DLL 1 IoCs

Processes:

f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe

pid process

912 f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1648	tTtgjD5SFzFnlGl.exe

pid	process
912	f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe

Drops Chrome extension 3 IoCs

Processes:

tTtgjD5SFzFnlGl.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgdaccmjebmfaofieidfggkilendheel\1.3\manifest.json	tTtgjD5SFzFnlGl.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgdaccmjebmfaofieidfggkilendheel\1.3\manifest.json	tTtgjD5SFzFnlGl.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgdaccmjebmfaofieidfggkilendheel\1.3\manifest.json	tTtgjD5SFzFnlGl.exe

Drops file in System32 directory 4 IoCs

Processes:

tTtgjD5SFzFnlGl.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	tTtgjD5SFzFnlGl.exe
File opened for modification	C:\Windows\System32\GroupPolicy	tTtgjD5SFzFnlGl.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	tTtgjD5SFzFnlGl.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	tTtgjD5SFzFnlGl.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

tTtgjD5SFzFnlGl.exe

pid process

1648 tTtgjD5SFzFnlGl.exe
1648 tTtgjD5SFzFnlGl.exe
1648 tTtgjD5SFzFnlGl.exe
1648 tTtgjD5SFzFnlGl.exe

pid	process
1648	tTtgjD5SFzFnlGl.exe
1648	tTtgjD5SFzFnlGl.exe
1648	tTtgjD5SFzFnlGl.exe
1648	tTtgjD5SFzFnlGl.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe

description	pid	process	target process
PID 912 wrote to memory of 1648	912	f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe	tTtgjD5SFzFnlGl.exe
PID 912 wrote to memory of 1648	912	f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe	tTtgjD5SFzFnlGl.exe
PID 912 wrote to memory of 1648	912	f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe	tTtgjD5SFzFnlGl.exe
PID 912 wrote to memory of 1648	912	f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe	tTtgjD5SFzFnlGl.exe

C:\Users\Admin\AppData\Local\Temp\f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe
"C:\Users\Admin\AppData\Local\Temp\f8c2d2a01e4d4d12dee928239bd25001a1d5122b9e8d3105bb1599b0c9da4576.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\tTtgjD5SFzFnlGl.exe
.\tTtgjD5SFzFnlGl.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1648

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\bgdaccmjebmfaofieidfggkilendheel\background.html
Filesize
140B

MD5
862c65cea8aa6dd33c1b8540c7d722b7

SHA1
67741a2caea114f35128bd8e6167d154b60c4b2b

SHA256
6423bfcbf03581e36be844b40dabc7ccb316cb0313f7c6ac49cc77432dd52112

SHA512
abfffae506414eb3f5b41086358145ca8bbc030306010566d82d9e9b6e20b1cfb75743c0f83cd530ddfefb92d03298040052b4c073afbb8f8ba46bf59d466560

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\bgdaccmjebmfaofieidfggkilendheel\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\bgdaccmjebmfaofieidfggkilendheel\dl9.js
Filesize
6KB

MD5
21a0e8cd1b1e378e20fb052eef33d3a0

SHA1
cc4ade992a5c43a851c4ea236bf08eaa36090b60

SHA256
045d684fabfc5a785f62e7f830359e722e353d7f60e05ed64af5b1fa15c4e12e

SHA512
dea1f971b1e15260dab69845c942602d295d1efa407570215066e533d1fb260c4097af4fe06f325d76bf01422069d8f1ebfbd880ecafc22ee4d39cd959ba0257

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\bgdaccmjebmfaofieidfggkilendheel\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\bgdaccmjebmfaofieidfggkilendheel\manifest.json
Filesize
498B

MD5
664e2884e17f23553a19eee317642194

SHA1
a28ccc088d6b6692646150f3e8f111e568723fb4

SHA256
ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

SHA512
b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
82c326e683923711517d6103bcb791de

SHA1
0c41c2a4194317fa49323f0b8e1dce6254205ab7

SHA256
2a9a47b52a9697bac821d2ec69d782c9c41f6098aa95aae0a215259151baf3ae

SHA512
3d8b48e0352dac50bca6b9fb9b148e8a32299476a7d53df7d8e7d601c704efbee7d743cc021b668e3032777f101a025a7dae7794878c05cf4613a35809434524

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
6067a8aa8cbaa58c377f6c6696a74dfd

SHA1
03c852a277a9e55732be7ccb6a29c3ce60a69b10

SHA256
1df7ea514adeb22ea25fc1be890725862e573c4ec05dae5bd9847a0374b8d8ef

SHA512
402b3f52e0ac5099fa0338e9a30f251195811a7a735a34eaf347ece22d287ae388dd4098f2fe1bbf41d0034b883d06519f63fcbba7d8807f7e86212d3277a2e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\[email protected]\install.rdf
Filesize
597B

MD5
551193cb4cfe3693e5a8c0958f90eaf9

SHA1
c6f3c8f7e96c88b1b2a0b0e676c60d6e5fb706a2

SHA256
bceb09437895a9d15840e3bb846195aa3feeb3f0e4f317cf8b42e7e49c2cdee9

SHA512
ab400e7f4fbf3c5b7d5187ffb87761b4ce726c2595c79159294db5b701b255405a3200c5989fda224f6a53be518d379c821133d25f2325e9f33a083317a84a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\tTtgjD5SFzFnlGl.dat
Filesize
1KB

MD5
875c69113b353cb3bc56b22b69551c6d

SHA1
bfdeceddb57fc005ccca773ffa3adf787f787928

SHA256
ba3809a849249b11aaca448f27e477d9f5085d0a2fd1cc41c7070ee5154b6cbc

SHA512
489dadff8336ab0253aa7afcc3aa0086c62e6f0978b9b361a68e4524ecb3fbc423fcd0beca9aeaad917fc2fa363dcb3b27be68c3bf3b1ddaed4181f5d9c44917

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\tTtgjD5SFzFnlGl.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\tTtgjD5SFzFnlGl.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/912-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1648-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads