fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627

Analysis

max time kernel
88s
max time network
95s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe
Size

931KB
MD5

b89c200d5e1083e8a62eb3128793c8f8
SHA1

63170df935eed8cd9894943c42bf2b801249d21a
SHA256

fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627
SHA512

4e976ad77665d477cd854f12a3f5660c89f4424b16245b5611710cec8f0b24ff644681051018f09016c658038acb6365975a2ce5fe51946ba0e4c2b7027e7e80
SSDEEP

24576:h1OYdaOvCZ/iWCvu/2sWsJA/jlt+DHhsO:h1OsFCpYO/dJJDHhsO

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Ue0CgYBZ3lj8yoh.exe

pid process

764 Ue0CgYBZ3lj8yoh.exe
Loads dropped DLL 1 IoCs

Processes:

fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe

pid process

1672 fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1672	fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe

Drops Chrome extension 3 IoCs

Processes:

Ue0CgYBZ3lj8yoh.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpeehbjiihdbbdjoicbnjbolllppogbb\2.0\manifest.json	Ue0CgYBZ3lj8yoh.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpeehbjiihdbbdjoicbnjbolllppogbb\2.0\manifest.json	Ue0CgYBZ3lj8yoh.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpeehbjiihdbbdjoicbnjbolllppogbb\2.0\manifest.json	Ue0CgYBZ3lj8yoh.exe

Drops file in System32 directory 4 IoCs

Processes:

Ue0CgYBZ3lj8yoh.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	Ue0CgYBZ3lj8yoh.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Ue0CgYBZ3lj8yoh.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Ue0CgYBZ3lj8yoh.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Ue0CgYBZ3lj8yoh.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Ue0CgYBZ3lj8yoh.exe

pid	process
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe
764	Ue0CgYBZ3lj8yoh.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Ue0CgYBZ3lj8yoh.exe

description	pid	process
Token: SeDebugPrivilege	764	Ue0CgYBZ3lj8yoh.exe
Token: SeDebugPrivilege	764	Ue0CgYBZ3lj8yoh.exe
Token: SeDebugPrivilege	764	Ue0CgYBZ3lj8yoh.exe
Token: SeDebugPrivilege	764	Ue0CgYBZ3lj8yoh.exe
Token: SeDebugPrivilege	764	Ue0CgYBZ3lj8yoh.exe
Token: SeDebugPrivilege	764	Ue0CgYBZ3lj8yoh.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe

description	pid	process	target process
PID 1672 wrote to memory of 764	1672	fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe	Ue0CgYBZ3lj8yoh.exe
PID 1672 wrote to memory of 764	1672	fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe	Ue0CgYBZ3lj8yoh.exe
PID 1672 wrote to memory of 764	1672	fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe	Ue0CgYBZ3lj8yoh.exe
PID 1672 wrote to memory of 764	1672	fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe	Ue0CgYBZ3lj8yoh.exe

C:\Users\Admin\AppData\Local\Temp\fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe
"C:\Users\Admin\AppData\Local\Temp\fd63c955111109e1ba34079cd58373f4f5fa949d65d423644b3c697f60a56627.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\Ue0CgYBZ3lj8yoh.exe
.\Ue0CgYBZ3lj8yoh.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
e57775d174688977cc224f6c43f78e9c

SHA1
351244f04870a6df4ca30a47709226e96cb502ea

SHA256
823c323b99133cb98dd370957a88f919a13a30c2382d5ac9c90a7dad5ed47275

SHA512
890b8cdda426c9d65b2257b2e8dc771404a7234c7411c64994284f0b2d8d0c525046f8deb1ce20d97dba14c4aa80e52c433706fcf3a5f82543dae9beb4a5ab17

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
38ae9ee98f156e89321848807e60ce6c

SHA1
6792858bd65f01f076d380fc23c7afd3bf999312

SHA256
0100d49e7fbd1dbd6616e8b2d42c1cbb47e79ae113489636f34d887780d8e20e

SHA512
08a0d2fd85f76b014e19849b9c846c8e79bb3b4e14ac5696ddfce0716ec9e57bde8fc21b5afb9f8126a6866f1345b6a4431c90a8c5a49ba47e424c9808b4182f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\[email protected]\install.rdf

Filesize
594B

MD5
a5ab3644d757e26554a0a717ecb6db6d

SHA1
dc1e4f7d8354b7795c3674e1a7a2ed8b1b2667a7

SHA256
d4325bf898169332003069b7ae1d22825c38ea2cade0c014eba9a33fa3fa8960

SHA512
473696b8713f774988f1757fed2c8423a6ca240771602819c91b9e7fea50209d7289452a2de2df40d024ea95fb71cd5ace41173a344160518081a44514f46b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\Ue0CgYBZ3lj8yoh.dat

Filesize
1KB

MD5
3c3d90aefa6b1881a9b203d8ed412ce9

SHA1
95fbf443dbdeec1a2e1a78470c7cb227e8c7c737

SHA256
0af6e55b279a166533393e55e4aa6ea0fb3573951e3ec42d5d09a7fc3a3ebd4e

SHA512
afd26e3ca05c104f8cf2b2d0cdfb7488572df8cf998080a3bbd6a562d4ce700e15aeae4ec10ec619f49fcd225db362607cac3db1cc30c54dc269311b65342aff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\Ue0CgYBZ3lj8yoh.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\mpeehbjiihdbbdjoicbnjbolllppogbb\background.html

Filesize
146B

MD5
9e4cdae44e10326e227ab77818e25ed7

SHA1
7685d90fbf615be9ab43c3475964e84ad5435116

SHA256
303a810c6360af86ca92f089ed3708690dbebaf5abac33afd3aa319cc82db348

SHA512
7bf8a915ecf9904722da00871326b71e2b0c72973e24ab6bd9263f21978a3ca737a64748e1f2fc270c958d79775127c657432a0017ef7048d3b6c9b788196065

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\mpeehbjiihdbbdjoicbnjbolllppogbb\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\mpeehbjiihdbbdjoicbnjbolllppogbb\dRzEw8lPU.js

Filesize
6KB

MD5
7cc763742347f946c2dc7af5859d7437

SHA1
246fe80899cc692f893dd5d5e2ec60884169e73d

SHA256
a9c88fbfad7da46b87b52777106d7e7678f9081ce584398c22acc2f40f0bb110

SHA512
4315e7076813d438372577b7e1285c501e195efef1b3107d6bb8a230bb3582d5452d948869ba748869faff8e6361d2149ac767a49c6b87e15bd40e7ab65634d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\mpeehbjiihdbbdjoicbnjbolllppogbb\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\mpeehbjiihdbbdjoicbnjbolllppogbb\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE1F7.tmp\Ue0CgYBZ3lj8yoh.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/764-56-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download