fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611

Analysis

max time kernel
150s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe
Size

931KB
MD5

ce50953fca4a76305a6357be672f039d
SHA1

5ffb0d273fa3598cb1bbeea521c2e14665c6f78c
SHA256

fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611
SHA512

fdcc5daa37742b0cb805bbef2b22824563bd75f8411ae0f7019b30570a00d47c17c4310b2e9e79a20882c0fa969be7a569a0cf66da4f61f534b6cdcce896d391
SSDEEP

24576:h1OYdaOcCZ/iWCvu/2sWsJA/jlt+DHhsd:h1OsmCpYO/dJJDHhsd

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

OsWUhY8EZyidi4Y.exe

pid process

4720 OsWUhY8EZyidi4Y.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

OsWUhY8EZyidi4Y.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dokjfbkheimlioogfdhnbjkiibfnacgp\2.0\manifest.json	OsWUhY8EZyidi4Y.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dokjfbkheimlioogfdhnbjkiibfnacgp\2.0\manifest.json	OsWUhY8EZyidi4Y.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dokjfbkheimlioogfdhnbjkiibfnacgp\2.0\manifest.json	OsWUhY8EZyidi4Y.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dokjfbkheimlioogfdhnbjkiibfnacgp\2.0\manifest.json	OsWUhY8EZyidi4Y.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dokjfbkheimlioogfdhnbjkiibfnacgp\2.0\manifest.json	OsWUhY8EZyidi4Y.exe

Drops file in System32 directory 4 IoCs

Processes:

OsWUhY8EZyidi4Y.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	OsWUhY8EZyidi4Y.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	OsWUhY8EZyidi4Y.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	OsWUhY8EZyidi4Y.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	OsWUhY8EZyidi4Y.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

OsWUhY8EZyidi4Y.exe

pid	process
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe
4720	OsWUhY8EZyidi4Y.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe

description	pid	process	target process
PID 884 wrote to memory of 4720	884	fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe	OsWUhY8EZyidi4Y.exe
PID 884 wrote to memory of 4720	884	fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe	OsWUhY8EZyidi4Y.exe
PID 884 wrote to memory of 4720	884	fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe	OsWUhY8EZyidi4Y.exe

C:\Users\Admin\AppData\Local\Temp\fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe
"C:\Users\Admin\AppData\Local\Temp\fe19654710805a0ddc42b1e5bbc265f2c02bb8454eff4b6b33d36316f1568611.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\OsWUhY8EZyidi4Y.exe
.\OsWUhY8EZyidi4Y.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
cdc81af951d4f6532f53c669cd976be4

SHA1
385753313c6694ecadcb407a004a34155caa6c25

SHA256
a16b43f5117b1e654485f899ede462ac78e2db86d5669ce13c27bbfcae45f975

SHA512
05dc1e69c9194e4a93893158c32cbb0a12f124d4f8ad659c90bca48bc1cb22544fc147c12e603a94059bb17a7f12bd87de377782da8da7a1b221ff0ef02a7a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
ee6bf9513d624179a8d119d4b6226c9b

SHA1
886b663ed40ed1a3744894075f60280bbe5dd985

SHA256
83fad022b8c14f6099d56ebb1706dcf7bb9eff36a008ad5790cb4aaf52f0916b

SHA512
c9afd717d62b7784797c12d9ea59fcce8c6a1be038067e2dc1b3ea2309069b497bca3166bb80a14ee7f199829f2d35654e9c92703bd70271dd097ea78441c647

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\[email protected]\install.rdf

Filesize
596B

MD5
a80dac0ec5d4b481d52b63ea6a7ce9ff

SHA1
0a567571dcb640c7e23a39fc8e2cab0f2adb7226

SHA256
1da9f98144dd7dc7a476f41be2be067e83cfcc92d4e4168c19148b0b0513f458

SHA512
286d0450c3b1cb890a67d565a55b032474b76367c0c10b58337c71d2c446e7459c17aaf7fd5e66a2de61181ed34e4481ef9afc695a77d005ddacf1b4cbecbd4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\OsWUhY8EZyidi4Y.dat

Filesize
1KB

MD5
ef81d97f0c027bcf8367647efa91251b

SHA1
0ad50feca7453aea33e8cb67541acaf122a7d8bf

SHA256
6bc9d5dcdd23d1f2dbab3063802305cbef017ec6684970927a1ce9a1479449d0

SHA512
f0f5bf87de3fd5916e44790891ca8953605fff5336bb9f9728251c7a66be140ae454f86a2b0072d6f8ee5d88a49855036e61acbe65875af749870513acf3b8fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\OsWUhY8EZyidi4Y.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\OsWUhY8EZyidi4Y.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\dokjfbkheimlioogfdhnbjkiibfnacgp\KHW1k1mI.js

Filesize
6KB

MD5
4b2bc54a1a550ce08ff8ed58fc9e542c

SHA1
302afd31d7c69e169a119df69cd80adbf10f36cc

SHA256
77a4b4d1830350f1ec5580a84bc80ff401fdac63226bc38f674bb507d70acc2c

SHA512
f0d30e3deb6128cc320ccff515be917749bf5019c9c54f2f94ab83d2a5bd902855c7d753893afe3709bcd2f51828ae69e16fc64c9f412d02edffd6ab1bb79f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\dokjfbkheimlioogfdhnbjkiibfnacgp\background.html

Filesize
145B

MD5
679835f54486aa7df78aed3d17f8b5f3

SHA1
5e457893a69eeb3f2d31f9d05226aeb543f9d552

SHA256
e1728a3bac646db25d9351c943f9a38212ab2d579575fbc9e0690b548809af9d

SHA512
4047c84a99cfa25dde54c6f730ec570816f03e247381512b6133322a0ada915b576e96b99555c8081d984c08eb83bb1688c6dcd863311af9a0f04a68b0d85b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\dokjfbkheimlioogfdhnbjkiibfnacgp\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\dokjfbkheimlioogfdhnbjkiibfnacgp\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA81C.tmp\dokjfbkheimlioogfdhnbjkiibfnacgp\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4720-132-0x0000000000000000-mapping.dmp

Download