fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d

Analysis

max time kernel
240s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe
Size

931KB
MD5

26b39aa80edf9cc2f0715f404db95da6
SHA1

29bbc2c5463dcf96f01c0414f91e6e3e5c536740
SHA256

fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d
SHA512

990712baa4f0128d39aadf9c5087e35d05dce43b8c3899a735cde05daca984c6b4447e779568527a35809894ae014083be41fe4371ec8b2856015d2b77dcd105
SSDEEP

24576:h1OYdaOaCZ/iWCvu/2sWsJA/jlt+DHhsV:h1OscCpYO/dJJDHhsV

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

MUxc2lQS8qkOS7S.exe

pid process

780 MUxc2lQS8qkOS7S.exe
Loads dropped DLL 1 IoCs

Processes:

fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe

pid process

1144 fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1144	fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe

Drops Chrome extension 3 IoCs

Processes:

MUxc2lQS8qkOS7S.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgohgnaejpmihniffomdllcbghnhindi\2.0\manifest.json	MUxc2lQS8qkOS7S.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgohgnaejpmihniffomdllcbghnhindi\2.0\manifest.json	MUxc2lQS8qkOS7S.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgohgnaejpmihniffomdllcbghnhindi\2.0\manifest.json	MUxc2lQS8qkOS7S.exe

Drops file in System32 directory 4 IoCs

Processes:

MUxc2lQS8qkOS7S.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	MUxc2lQS8qkOS7S.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	MUxc2lQS8qkOS7S.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	MUxc2lQS8qkOS7S.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	MUxc2lQS8qkOS7S.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

MUxc2lQS8qkOS7S.exe

pid	process
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe
780	MUxc2lQS8qkOS7S.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

MUxc2lQS8qkOS7S.exe

description	pid	process
Token: SeDebugPrivilege	780	MUxc2lQS8qkOS7S.exe
Token: SeDebugPrivilege	780	MUxc2lQS8qkOS7S.exe
Token: SeDebugPrivilege	780	MUxc2lQS8qkOS7S.exe
Token: SeDebugPrivilege	780	MUxc2lQS8qkOS7S.exe
Token: SeDebugPrivilege	780	MUxc2lQS8qkOS7S.exe
Token: SeDebugPrivilege	780	MUxc2lQS8qkOS7S.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe

description	pid	process	target process
PID 1144 wrote to memory of 780	1144	fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe	MUxc2lQS8qkOS7S.exe
PID 1144 wrote to memory of 780	1144	fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe	MUxc2lQS8qkOS7S.exe
PID 1144 wrote to memory of 780	1144	fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe	MUxc2lQS8qkOS7S.exe
PID 1144 wrote to memory of 780	1144	fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe	MUxc2lQS8qkOS7S.exe

C:\Users\Admin\AppData\Local\Temp\fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe
"C:\Users\Admin\AppData\Local\Temp\fe2ec3563e2af014930961bd591519ce9e6b0f08bdab3f73cfc5923dfccab68d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144

C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\MUxc2lQS8qkOS7S.exe
.\MUxc2lQS8qkOS7S.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
51b146edd8c1f1c04cc611b92459751f

SHA1
dcb6283436f1ea0b815f787c53b561bd6805fe66

SHA256
f75599cb4f3e473c2ce68e65d0bde7ccca948d8307df6bcede2d6f2e42e1be93

SHA512
df42e1245a7cb0bc653b82af9b2a9ddbf209f6de618a4a6261c8f1bdf780e6d0c3d5b1c16d28ded3011781b458f59c6c4a2afca11cc53c68c4fe8f17d6d50cef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
6715a413a32d7333f2be10ef1021365c

SHA1
f1cc64479e05f9c695aaacd9aca463b9ab9611a5

SHA256
f4bf36ec5614a92932f989285fe215a0f991de926233f127e8f63dc4d1670588

SHA512
42bb81bba95760cca02f9e239b051820674ef1171a97cd5cabcb5f8cf220b559470ac802748eaa103f30a3638ab05d82c27cbbee07f959a0f3f5696e82375d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\[email protected]\install.rdf
Filesize
593B

MD5
81a7f39d1de9771fd0e6b90333c94d3f

SHA1
cac4e59889713d9073a94795d2ddd717ee10220d

SHA256
f877e95c8c85bcae1135529956c1ff01961d1170924fed9043b4c15d0be79fc6

SHA512
81fb1af73551f450245b68cd42d2e4fe7d457c5ef7b300a8aaf689a65679c4805572b75f8167cd3d210067b4902da215e9b6ca3531abf2271432041f745a690d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\MUxc2lQS8qkOS7S.dat
Filesize
1KB

MD5
f77129e1793d75b961afd0d4ddf4d0ca

SHA1
4c38d78fbfdd35c4db486e8485478c5f9d82baf5

SHA256
bb38b6dca173f3595476af022f787e9ff02292b541e192bd8d619b30bc0d5b89

SHA512
e013f99041db734fdd6dce2426efaa2a9a0236bcd76d992e65dff18b8d3ea438d8e5815af4473633393fdb3a06adcc06f605a9d7bfe39255c161562d485dab87

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\MUxc2lQS8qkOS7S.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\fgohgnaejpmihniffomdllcbghnhindi\background.html
Filesize
138B

MD5
7884b80b61a1d3890fa90eebb5dcc8e1

SHA1
c2c17896723b5926bc16dac083748bf8fcb59290

SHA256
4e9295d05361d4a60459747d6270090190b1fa735b6cc4f8c178436107406e77

SHA512
0f427d19c0c6f04fc91f9dcc6f722cb8b0f66c732b0045539a18e1003f04f8e3402568c1546cb56ae810341a1f54da29f71c3eabae6cc66acfa1c9e54361207e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\fgohgnaejpmihniffomdllcbghnhindi\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\fgohgnaejpmihniffomdllcbghnhindi\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\fgohgnaejpmihniffomdllcbghnhindi\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3821.tmp\fgohgnaejpmihniffomdllcbghnhindi\u.js
Filesize
6KB

MD5
2fed56e9ff2c3d347d5777b97c7f021a

SHA1
56bfe42f6e995e219ae4a345937c1a3344d1da1a

SHA256
e8421a4148161fc484587624e612ad14255da2b1e3b3b249f3322ab07951e43c

SHA512
0c741474d37773cb5d08501bc323e2a76fb8fc32cd083e1820be9f497e17d351d1cd9d934a9f2dde7a3f294266ef689ac4d81f24577f01b18555a27f5745cf4e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3821.tmp\MUxc2lQS8qkOS7S.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/780-56-0x0000000000000000-mapping.dmp

Download
memory/1144-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads