fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d

Analysis

max time kernel
224s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe
Size

931KB
MD5

b9539061d5bd60ecd15cba42a50b2226
SHA1

6e2d9c653c712200c19e55f817c5cad922b1d84f
SHA256

fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d
SHA512

d00afded82abbf2a5fe30f461e81ff64ebcc6ccf2f45c419e60f5d79e11276877ef5ac90405fced5e83d9e546040a2b87185a60af1b6a54f6b83825cbdb2129a
SSDEEP

24576:h1OYdaOYCZ/iWCvu/2sWsJA/jlt+DHhsf:h1Os6CpYO/dJJDHhsf

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

PI64fieNmBOpHcR.exe

pid process

268 PI64fieNmBOpHcR.exe
Loads dropped DLL 1 IoCs

Processes:

fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe

pid process

1940 fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1940	fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe

Drops Chrome extension 3 IoCs

Processes:

PI64fieNmBOpHcR.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkmdigckdjomlmkngjnpeohbenkiooel\2.0\manifest.json	PI64fieNmBOpHcR.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkmdigckdjomlmkngjnpeohbenkiooel\2.0\manifest.json	PI64fieNmBOpHcR.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkmdigckdjomlmkngjnpeohbenkiooel\2.0\manifest.json	PI64fieNmBOpHcR.exe

Drops file in System32 directory 4 IoCs

Processes:

PI64fieNmBOpHcR.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	PI64fieNmBOpHcR.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	PI64fieNmBOpHcR.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	PI64fieNmBOpHcR.exe
File opened for modification	C:\Windows\System32\GroupPolicy	PI64fieNmBOpHcR.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

PI64fieNmBOpHcR.exe

pid	process
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe
268	PI64fieNmBOpHcR.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

PI64fieNmBOpHcR.exe

description	pid	process
Token: SeDebugPrivilege	268	PI64fieNmBOpHcR.exe
Token: SeDebugPrivilege	268	PI64fieNmBOpHcR.exe
Token: SeDebugPrivilege	268	PI64fieNmBOpHcR.exe
Token: SeDebugPrivilege	268	PI64fieNmBOpHcR.exe
Token: SeDebugPrivilege	268	PI64fieNmBOpHcR.exe
Token: SeDebugPrivilege	268	PI64fieNmBOpHcR.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe

description	pid	process	target process
PID 1940 wrote to memory of 268	1940	fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe	PI64fieNmBOpHcR.exe
PID 1940 wrote to memory of 268	1940	fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe	PI64fieNmBOpHcR.exe
PID 1940 wrote to memory of 268	1940	fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe	PI64fieNmBOpHcR.exe
PID 1940 wrote to memory of 268	1940	fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe	PI64fieNmBOpHcR.exe

C:\Users\Admin\AppData\Local\Temp\fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe
"C:\Users\Admin\AppData\Local\Temp\fedbd1c28da8dc74346af528cf0c6215e63832221e02e11a445719264004d68d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\PI64fieNmBOpHcR.exe
.\PI64fieNmBOpHcR.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\PI64fieNmBOpHcR.dat

Filesize
1KB

MD5
19e29d817d393a07c81a81a7e38b4dc4

SHA1
12204c465d9e4f0ff10aec06fca67f7fa88eda98

SHA256
491d64d1ea9e4c0473697a4b1255b07ecdbefb98ac9992a2fa802f5366295da6

SHA512
48f7b823aee359ec9ffb6ec4cebcaf8c5aefcf61251bd6c785294aff09b93941ead4d8b6067057d826e4d038e611fc13dd4a2b43c02d975159d96ec1ae074e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\PI64fieNmBOpHcR.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
1ad48e61b016354f9e26bbc22cc4c886

SHA1
ab1bbce93cf75fe80f5b7d83ee33d0c513b7001a

SHA256
c83d46c45865f7bdd1d62a900367084dacbdb2602cf0a20c9b9782d680941d6d

SHA512
6885b86acc651d1eedbc1b1adae34cd49a28db1cc694d058995c7ef771e8c65dc21ddc0c7c303f886ce5a9e871491e56964af4e20c68b934e635585ed9bceb48

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
b45917ba02851b913b0a2d47c850fc98

SHA1
0d73ddeeab8e73b068f26e2bac336035c0b0dbc9

SHA256
0be37baab6252113766b2c9c41a99b0b04c63e40d801c72ac9b4933bba3b8122

SHA512
8e3bed4d50f629247e43311b0dc6205ba2dcb0ae1dfa7e02fe3f2c5574dcc28365074436e264668e45858a37ddfe221dc3c28d7b6f45c93f651ab7aa3b65f57c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\[email protected]\install.rdf

Filesize
591B

MD5
b1092d30b5c82e301d5c87a48716570a

SHA1
b28747edd2cf84d4c810e9eadb14c7df416e9a8a

SHA256
8563fcc7ecd91addb0afcc5f5eeb2aaf5be555c53125d44d192cb85cfec91f03

SHA512
534705789e9f15b75b20c59e4ca89a27d21c6b7402bd29203f8a22114b21a93d0ea7d9d33ab98b3ad002848572ee4a177f9fe863c70b9e16b0c466521edfe975

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\hkmdigckdjomlmkngjnpeohbenkiooel\background.html

Filesize
141B

MD5
2b8aeb57278006893513f00f3aa608ee

SHA1
5257268025162a1d253e5ac97480caa2dce9595b

SHA256
9531644fc31a158eb61112c12e51e190539c655b0a741fbc109a8846ac4d1de2

SHA512
84c84990182afc2d118216419dcdc0895438386931bec6e5db143c8f54a45df8eeb6ebacf9d8da6a0d82e1310e8dd3ce7b30b6e332cec078be171e297bc879f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\hkmdigckdjomlmkngjnpeohbenkiooel\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\hkmdigckdjomlmkngjnpeohbenkiooel\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\hkmdigckdjomlmkngjnpeohbenkiooel\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\hkmdigckdjomlmkngjnpeohbenkiooel\zZEi.js

Filesize
6KB

MD5
cf24d17352845bd2377ec43ce7b0d013

SHA1
7b90d0169d42beb8c5b979e2d5e02c54de069adb

SHA256
51fc1c3edc84ffe1e70e41d010c20c5c435ca076462666a7767a279e25353baa

SHA512
18e97a0eccc6ad2abe6ba7afd639d3e4eacd859348ac442aafa6190f4d8da82f4494449136e6504199e35c5fd3834259240281db36bfc99f78244adf60143b6f

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF99C.tmp\PI64fieNmBOpHcR.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/268-56-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download