fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6

Analysis

max time kernel
139s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe
Size

920KB
MD5

873c224675610692fba12eeb080356e7
SHA1

70e6aa2ac9465fa60a03ff861d040fd54854cb04
SHA256

fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6
SHA512

1a8664595aba33a53120ae1ecdc74680efdcaab97b4b2762fe48780291c16b862ec151c1528720bb3fde7c8cfed1929b56d477bcd44c46a4a15ee4c40d6fdbfe
SSDEEP

24576:h1OYdaOZMtdHAqcdDVhYwiei7+EpFAh/kKp:h1OsUPHVmVhYwiLtKkKp

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

OeuN7n4xsYeHZiQ.exe

pid process

3928 OeuN7n4xsYeHZiQ.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

OeuN7n4xsYeHZiQ.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gggpcplolcmfcgflgbgfmmicegimdkdg\2.0\manifest.json	OeuN7n4xsYeHZiQ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gggpcplolcmfcgflgbgfmmicegimdkdg\2.0\manifest.json	OeuN7n4xsYeHZiQ.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gggpcplolcmfcgflgbgfmmicegimdkdg\2.0\manifest.json	OeuN7n4xsYeHZiQ.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gggpcplolcmfcgflgbgfmmicegimdkdg\2.0\manifest.json	OeuN7n4xsYeHZiQ.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gggpcplolcmfcgflgbgfmmicegimdkdg\2.0\manifest.json	OeuN7n4xsYeHZiQ.exe

Drops file in System32 directory 4 IoCs

Processes:

OeuN7n4xsYeHZiQ.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	OeuN7n4xsYeHZiQ.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	OeuN7n4xsYeHZiQ.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	OeuN7n4xsYeHZiQ.exe
File opened for modification	C:\Windows\System32\GroupPolicy	OeuN7n4xsYeHZiQ.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

OeuN7n4xsYeHZiQ.exe

pid	process
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe
3928	OeuN7n4xsYeHZiQ.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

OeuN7n4xsYeHZiQ.exe

description	pid	process
Token: SeDebugPrivilege	3928	OeuN7n4xsYeHZiQ.exe
Token: SeDebugPrivilege	3928	OeuN7n4xsYeHZiQ.exe
Token: SeDebugPrivilege	3928	OeuN7n4xsYeHZiQ.exe
Token: SeDebugPrivilege	3928	OeuN7n4xsYeHZiQ.exe
Token: SeDebugPrivilege	3928	OeuN7n4xsYeHZiQ.exe
Token: SeDebugPrivilege	3928	OeuN7n4xsYeHZiQ.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe

description	pid	process	target process
PID 1560 wrote to memory of 3928	1560	fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe	OeuN7n4xsYeHZiQ.exe
PID 1560 wrote to memory of 3928	1560	fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe	OeuN7n4xsYeHZiQ.exe
PID 1560 wrote to memory of 3928	1560	fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe	OeuN7n4xsYeHZiQ.exe

C:\Users\Admin\AppData\Local\Temp\fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe
"C:\Users\Admin\AppData\Local\Temp\fdcf2dfcf6b8e7f8f5d75850c1d2fe7216b8f82e056a8c3c76561ec8020255a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\OeuN7n4xsYeHZiQ.exe
.\OeuN7n4xsYeHZiQ.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\OeuN7n4xsYeHZiQ.dat

Filesize
1KB

MD5
9d4d9e8e59c7b820716eeef6ff5bcaaf

SHA1
ade0979826094e5def476828f2164b8868d2b2dc

SHA256
1a93e5f24ab70d726b4b78454a57afc897b5b722f8c4628796cfa18a0dc953d2

SHA512
d9f9fd5dc23a2b91ee2d191972bb23562626695d6ecb1697b2961bc97081e41dbce3caa7d7486246bf378a0afe0b80ae1b4a8ead02feafa985689627c4510d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\OeuN7n4xsYeHZiQ.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\OeuN7n4xsYeHZiQ.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\gggpcplolcmfcgflgbgfmmicegimdkdg\background.html

Filesize
139B

MD5
386405867e936e40ee8f68f6b51607f5

SHA1
d31aa955016445a11f6d97f447616c9dd2081ccd

SHA256
89776ffeb78d329d8f531cb77e42315e357f1fe202dd5b1cfb585b39f412517e

SHA512
fff0ee157ad686867dc9d1549168c6569d846239fb66086932ef0257aa222bd96c95d7048b516d96db2949bbfc136f90c6a8c600886ecda27fcd16b95906557f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\gggpcplolcmfcgflgbgfmmicegimdkdg\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\gggpcplolcmfcgflgbgfmmicegimdkdg\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\gggpcplolcmfcgflgbgfmmicegimdkdg\mT.js

Filesize
6KB

MD5
610dc9856f058d18c18a4a748e728699

SHA1
f33c1ac0c0bab7ad51877caa76bab157459d4ad8

SHA256
ecb4ae5f28f42193c331531c29b4030b500e3cb70d5afc7d917564dad8d90e10

SHA512
b7c8235a75e3ab0c585d2aaffa27bb9eb9f462f9f4db734c416dc5c1d362fe859030e7b1876ee0c0cde5c4b0880a41e1a4debf036436f0609d5d16fa8d67b503

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\gggpcplolcmfcgflgbgfmmicegimdkdg\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
65aa4d5f125d90fd16ac604385831a3d

SHA1
5108cabf5d4d89c85ae878bdd6d12a7b2939f80f

SHA256
92997d499eb7d68df35f709ef2e22f2c1c98f7fd2c09eed8771eb740df1f6a67

SHA512
19de66b8d308d02f0664509ead13b03ce7787057ff4b54cad646c97735c048fa7bc78cb107286ab60f8a373adef461c089b32fec91ebe92c5b3182fea8ee7bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
08b900ff9d42bcb9edca91edcaa2ff2c

SHA1
c473f56202a2a22c0179e6ea56f9af93bfc5707c

SHA256
6d10ca5cbb53bebc8bd0afa091c6ae5a26c6db7bd9d704c4d49f84f804313078

SHA512
0d7272ef1412de3eaa2a06a911e8bc75484ccc315514a2a8c012a3603c249de4382463c156ba6bb016b3e68acd2693c894e9d87aafbc9e07a4ecb8022c17918e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS705.tmp\[email protected]\install.rdf

Filesize
593B

MD5
bc13a93be6ec7ff260b866baa93ee56b

SHA1
befe7e0234f1b813c2f4129ec54b46778abdf355

SHA256
13f8f9010ec632cb4e6b0893e80a7a57eb24b54a349a38676aca964a12affcca

SHA512
b699d9e55b277b2120aa45ae221acc9025f23243008e9ea290fae6763343fa8f6c0b57cf45bb238d050d8f1343e7982cd6da822be8d8d545d7724401f668b37f

Download Submit
memory/3928-132-0x0000000000000000-mapping.dmp

Download