fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8

Analysis

max time kernel
137s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe
Size

920KB
MD5

00dec00e5e76f41ec1df003fffdfaec4
SHA1

511a22f6c4122cce13b8e8e76faf979baac9c8a0
SHA256

fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8
SHA512

57b39687236d70956df1f9d24378a9a8ece7b01e784711785cb375286fd824351aed811f077b1ddd46a929e82e0e63fa0c6f6a301e3e3214a47a50b33f41a9d4
SSDEEP

24576:h1OYdaO/MtdHAqcdDVhYwiei7+EpFAh/kKv:h1OsqPHVmVhYwiLtKkKv

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

N9jIHGSG15F2LvB.exe

pid process

4656 N9jIHGSG15F2LvB.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

N9jIHGSG15F2LvB.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbamcbgpkgjlakeiccpgjipfanbmamac\2.0\manifest.json	N9jIHGSG15F2LvB.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbamcbgpkgjlakeiccpgjipfanbmamac\2.0\manifest.json	N9jIHGSG15F2LvB.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbamcbgpkgjlakeiccpgjipfanbmamac\2.0\manifest.json	N9jIHGSG15F2LvB.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbamcbgpkgjlakeiccpgjipfanbmamac\2.0\manifest.json	N9jIHGSG15F2LvB.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbamcbgpkgjlakeiccpgjipfanbmamac\2.0\manifest.json	N9jIHGSG15F2LvB.exe

Drops file in System32 directory 4 IoCs

Processes:

N9jIHGSG15F2LvB.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	N9jIHGSG15F2LvB.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	N9jIHGSG15F2LvB.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	N9jIHGSG15F2LvB.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	N9jIHGSG15F2LvB.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

N9jIHGSG15F2LvB.exe

pid	process
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe
4656	N9jIHGSG15F2LvB.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N9jIHGSG15F2LvB.exe

description	pid	process
Token: SeDebugPrivilege	4656	N9jIHGSG15F2LvB.exe
Token: SeDebugPrivilege	4656	N9jIHGSG15F2LvB.exe
Token: SeDebugPrivilege	4656	N9jIHGSG15F2LvB.exe
Token: SeDebugPrivilege	4656	N9jIHGSG15F2LvB.exe
Token: SeDebugPrivilege	4656	N9jIHGSG15F2LvB.exe
Token: SeDebugPrivilege	4656	N9jIHGSG15F2LvB.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe

description	pid	process	target process
PID 1824 wrote to memory of 4656	1824	fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe	N9jIHGSG15F2LvB.exe
PID 1824 wrote to memory of 4656	1824	fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe	N9jIHGSG15F2LvB.exe
PID 1824 wrote to memory of 4656	1824	fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe	N9jIHGSG15F2LvB.exe

C:\Users\Admin\AppData\Local\Temp\fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe
"C:\Users\Admin\AppData\Local\Temp\fdf374015d9261c495c36d4f497cc332a9098c1cc5c075834a28e37dc431cda8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\N9jIHGSG15F2LvB.exe
.\N9jIHGSG15F2LvB.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\N9jIHGSG15F2LvB.dat
Filesize
1KB

MD5
4b8c78d5bc6fbfd16b9e48be891de40e

SHA1
c5f9e539218b6dad40c77093303580dd1e511880

SHA256
dcc5f9d0753efb12a35a0cf744897700006acd8b0a2106b6df95cf6c82d8c097

SHA512
83e072a36954aa85354b7fe9bc26ad2cefb7947236e860840c9c63991dc4b4c22a1dd89ee8446df7b08a32712b209c82b6a3997f591c3e655b5868eabecc1ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\N9jIHGSG15F2LvB.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\N9jIHGSG15F2LvB.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
5221ddf44ef41e0ecdf76fb0751e8c71

SHA1
bb71993cee94a8571ff983856aef7f04ef36b0aa

SHA256
704fcca03b7ef39dceb8c8e58c7db6d3435f138161a1a5453bc4802cd97f4c0a

SHA512
7da29adfa5163b27a0c012cc552dd65fcdefd28acea20cb003e43b3decb50537c4ff251f392277a0c80d1bb8a5d0c841f09590ec2cefef1ee3bec941c2ef99c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
2a15c2d97fe6bd3f48e402271fb6b54c

SHA1
5671fcaefff48418116d7d7d8515fa2b0e359090

SHA256
f91d0fe8bf0e355772a4a9b76a763e6d16fedc4dd411113ac51629bf84e5c8b3

SHA512
cd2af5c8c64326f301409e2fc0d1215141e3aec227b51baa62e92d36e5043c8ec61d12659940909449cf943fd97922d285a30b2833689f85298f99cb319d6a78

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\[email protected]\install.rdf
Filesize
599B

MD5
4fd0e1470c10562d492bb25f8eaf9a4f

SHA1
40abc273320e1d73f1e6a808bcc6c6ea1a13e7af

SHA256
63c2585aaba5c146c87e4a810d96cb2daf1029c9da299deebe7d6f9f2d9a6bf6

SHA512
82da7bf83cb1afabe16853c65c0be959f657fd5c26814223c69a010f6c272e0bcfe9c9a9e2ce668861d4ed0b0f0348f74438401fdfb2e7f4a06ae29c9e2fb06b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\bbamcbgpkgjlakeiccpgjipfanbmamac\background.html
Filesize
139B

MD5
7483b921768908df872ac093b3279721

SHA1
c9d3211e14e792381506ba1e2ef32b9689a1e9f4

SHA256
22e7cb3f91ef0a35c304f36b618f943113d9f57be14347aa4c3e455985720b43

SHA512
89371b480eb17b916b42a467e38d692bcdb5042a0a432830882e018c209d97cd8248f71ce723a0010c62dde0010d210ffb970281c2e82b343786ab5f08cddb27

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\bbamcbgpkgjlakeiccpgjipfanbmamac\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\bbamcbgpkgjlakeiccpgjipfanbmamac\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\bbamcbgpkgjlakeiccpgjipfanbmamac\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF7B3.tmp\bbamcbgpkgjlakeiccpgjipfanbmamac\rA.js
Filesize
6KB

MD5
f5e4fc5233abe6db135c34986ca61f64

SHA1
8dc0c97c1ba21f5e7d3c0f01db8ca7918aaeafe4

SHA256
251277555620d1558ae71b4705835148044982240c854a619187cd7753a78e38

SHA512
0af20704d74e423570cf60c0c2a9c07df744e5c5ed2e76007f35281449857e1dcd5373486c605780446268f172da41987f97642766507e798016f6ae8a09cf31

Download Submit
memory/4656-132-0x0000000000000000-mapping.dmp

Download