fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2

Analysis

max time kernel
201s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe
Size

924KB
MD5

8e12fe7bcfff6933fecce6e7304f92e1
SHA1

90362a8f4998acc376693fe570708fad84123131
SHA256

fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2
SHA512

522646c3ed4eb23c4a736381d2b3483c16e3a785e9659140a501ab691ec9cbe3768b4d589d5968d1825c79411ba3391cad748b5349bc02e655314de8043fcc3d
SSDEEP

24576:h1OYdaOppi3TiqRomivrVhjlLZzpHAzSpkGk8t8Fi:h1OszGX0rN1lHAKkZ8t8Fi

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Say9vD2UcUpJ5bl.exe

pid process

2860 Say9vD2UcUpJ5bl.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

Say9vD2UcUpJ5bl.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjpapmnnkaadinfmfodcngejpaembadf\2.0\manifest.json	Say9vD2UcUpJ5bl.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjpapmnnkaadinfmfodcngejpaembadf\2.0\manifest.json	Say9vD2UcUpJ5bl.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjpapmnnkaadinfmfodcngejpaembadf\2.0\manifest.json	Say9vD2UcUpJ5bl.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjpapmnnkaadinfmfodcngejpaembadf\2.0\manifest.json	Say9vD2UcUpJ5bl.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjpapmnnkaadinfmfodcngejpaembadf\2.0\manifest.json	Say9vD2UcUpJ5bl.exe

Drops file in System32 directory 4 IoCs

Processes:

Say9vD2UcUpJ5bl.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	Say9vD2UcUpJ5bl.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Say9vD2UcUpJ5bl.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Say9vD2UcUpJ5bl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Say9vD2UcUpJ5bl.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Say9vD2UcUpJ5bl.exe

pid	process
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe
2860	Say9vD2UcUpJ5bl.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Say9vD2UcUpJ5bl.exe

description	pid	process
Token: SeDebugPrivilege	2860	Say9vD2UcUpJ5bl.exe
Token: SeDebugPrivilege	2860	Say9vD2UcUpJ5bl.exe
Token: SeDebugPrivilege	2860	Say9vD2UcUpJ5bl.exe
Token: SeDebugPrivilege	2860	Say9vD2UcUpJ5bl.exe
Token: SeDebugPrivilege	2860	Say9vD2UcUpJ5bl.exe
Token: SeDebugPrivilege	2860	Say9vD2UcUpJ5bl.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe

description	pid	process	target process
PID 1084 wrote to memory of 2860	1084	fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe	Say9vD2UcUpJ5bl.exe
PID 1084 wrote to memory of 2860	1084	fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe	Say9vD2UcUpJ5bl.exe
PID 1084 wrote to memory of 2860	1084	fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe	Say9vD2UcUpJ5bl.exe

C:\Users\Admin\AppData\Local\Temp\fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe
"C:\Users\Admin\AppData\Local\Temp\fe740e97b8fe81636a8c69be64cb120c57b4008b81f6b8a6fe97a67e8a20c5d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\Say9vD2UcUpJ5bl.exe
.\Say9vD2UcUpJ5bl.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\Say9vD2UcUpJ5bl.dat
Filesize
1KB

MD5
e275d0406afe3f127df33215e86258c5

SHA1
02bf1e79fb4454f4c0b2f5f685bcf143eaea2a99

SHA256
eb937ebfbb06466f37781f2f4580b19df3e3968f130276953c4f6cccfabc9a5b

SHA512
77acdb27008af8538efbf036548410a93e31e90d66177b20eedad71d6c056550ed545541fa0973cd0b672c5fceaf8b7846f70e53457ea9d0d69d2b6a393ee754

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\Say9vD2UcUpJ5bl.exe
Filesize
765KB

MD5
754a15785aaff9c8a9ab023ceaefe6f4

SHA1
f4fe2eaf0ab6de7c630693a95f621cd7bcd7891d

SHA256
8265556161785f62a6eb0eba4edaa6b1045694d1bd33015c34b4a89577df608f

SHA512
9ed0ce64411d3e71dbf6064c15310d257295958d8e762d0704254f88c9d1f676a341bf92d162719075ed9050c9b42a9bdbcc69d5355395257098bbcb1155a13f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\Say9vD2UcUpJ5bl.exe
Filesize
765KB

MD5
754a15785aaff9c8a9ab023ceaefe6f4

SHA1
f4fe2eaf0ab6de7c630693a95f621cd7bcd7891d

SHA256
8265556161785f62a6eb0eba4edaa6b1045694d1bd33015c34b4a89577df608f

SHA512
9ed0ce64411d3e71dbf6064c15310d257295958d8e762d0704254f88c9d1f676a341bf92d162719075ed9050c9b42a9bdbcc69d5355395257098bbcb1155a13f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\gjpapmnnkaadinfmfodcngejpaembadf\BXx.js
Filesize
6KB

MD5
eab216a54137e51f7a391bb7f1262e94

SHA1
e18066d0f8baaf180346e41e3514a4d3cb01ca2c

SHA256
74a997c33411887a4ae89dca3c91836ba9711d988eb6d569fa95edeb4fc16928

SHA512
30fe399f1da42bc59342138e5406accfe0645150b331043b6151d0fdff6a08d9cff0a4367eb9c123b8c2357571b84f58c53210ca3858613a534330ee112283c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\gjpapmnnkaadinfmfodcngejpaembadf\background.html
Filesize
140B

MD5
cd5d4ce8dd501f453e58886bf2471e9b

SHA1
66a126d4310eeacccb98ba7c08fca036a57636a2

SHA256
db0097e0927d29286a3ffed1899a171e605fe52fac5c37bf024ae1476fc0eba5

SHA512
86b2a675a6e09f7b36bc2018057057a137519a90278e4187735e08b6233060d2166b3de1958082e443a6416b76eef145d1fc21109f3af64439f6d4be8b315c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\gjpapmnnkaadinfmfodcngejpaembadf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\gjpapmnnkaadinfmfodcngejpaembadf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\gjpapmnnkaadinfmfodcngejpaembadf\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
caf6a516a7b679abd25c12dc09a3563a

SHA1
34348b5a42242b547f2786647fbb126ad54be219

SHA256
31daf373c3e23fcfb2e5ff89c357a43b71e50b91208297b30bd152407694e94d

SHA512
029237ea38c1194d615bf60b1e0e77350583637e86606210fd2d5ee63e9bdfa6d79976102d4cd10cda286ae11e602482f657a3bba1e375b15722db5a7e3fc0c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
f6a6fe03921b701121945d9f2fb06d4e

SHA1
60790dc5f01e1fc608e3e936d0a1355afd101033

SHA256
d3b3dd4e6f9defe75cdb060f1b2e2fcbf116435db8c96c1d50fb7fab80d59f01

SHA512
717c8a368f64d1948934ddcd6e2037ea6b39eb26a28ea60e8721dda5705126636716d89da838d624f81db1b5732de1af6442616040fac6b1ebb60aff5164939c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5525.tmp\[email protected]\install.rdf
Filesize
596B

MD5
cb5323afd610e7a7f269d09017fe2313

SHA1
5c12126400494b860b68cb1b836e235a95e6f606

SHA256
2cc35d1f6330865969a4fe2a20f9538bdd2e7d19475e5dadf6afc757bd1889fd

SHA512
d00d38a50fc9142b7007c5a35d4e07f1ac2f9645dc4c25c30a74152f500e31cfcb885c8739a159d7f453696686ce22dcebf28e4b842e0292b498b6360b14bf92

Download Submit
memory/2860-132-0x0000000000000000-mapping.dmp

Download