fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860

Analysis

max time kernel
189s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe
Size

931KB
MD5

2fb85a28e42114f7b5e6265d32cb769b
SHA1

69171ac4942e5fd36860a0f58199f6ad8c230e6d
SHA256

fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860
SHA512

bedc9d73c324e15055a18bf9fe192573202cd406b9a0c870b88076ed86f3757177b6ed33fb062d7e18bcc1d3f0146323eb54722633857ffa78788b9da594af97
SSDEEP

24576:h1OYdaOtCZ/iWCvu/2sWsJA/jlt+DHhsc:h1OsvCpYO/dJJDHhsc

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

NLgN9aF0VcNEhZC.exe

pid process

4688 NLgN9aF0VcNEhZC.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

NLgN9aF0VcNEhZC.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\inijgenilmekkpemimeiemmhgfpkjbbk\2.0\manifest.json	NLgN9aF0VcNEhZC.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\inijgenilmekkpemimeiemmhgfpkjbbk\2.0\manifest.json	NLgN9aF0VcNEhZC.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\inijgenilmekkpemimeiemmhgfpkjbbk\2.0\manifest.json	NLgN9aF0VcNEhZC.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\inijgenilmekkpemimeiemmhgfpkjbbk\2.0\manifest.json	NLgN9aF0VcNEhZC.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\inijgenilmekkpemimeiemmhgfpkjbbk\2.0\manifest.json	NLgN9aF0VcNEhZC.exe

Drops file in System32 directory 4 IoCs

Processes:

NLgN9aF0VcNEhZC.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	NLgN9aF0VcNEhZC.exe
File opened for modification	C:\Windows\System32\GroupPolicy	NLgN9aF0VcNEhZC.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	NLgN9aF0VcNEhZC.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	NLgN9aF0VcNEhZC.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

NLgN9aF0VcNEhZC.exe

pid	process
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe
4688	NLgN9aF0VcNEhZC.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

NLgN9aF0VcNEhZC.exe

description	pid	process
Token: SeDebugPrivilege	4688	NLgN9aF0VcNEhZC.exe
Token: SeDebugPrivilege	4688	NLgN9aF0VcNEhZC.exe
Token: SeDebugPrivilege	4688	NLgN9aF0VcNEhZC.exe
Token: SeDebugPrivilege	4688	NLgN9aF0VcNEhZC.exe
Token: SeDebugPrivilege	4688	NLgN9aF0VcNEhZC.exe
Token: SeDebugPrivilege	4688	NLgN9aF0VcNEhZC.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe

description	pid	process	target process
PID 3500 wrote to memory of 4688	3500	fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe	NLgN9aF0VcNEhZC.exe
PID 3500 wrote to memory of 4688	3500	fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe	NLgN9aF0VcNEhZC.exe
PID 3500 wrote to memory of 4688	3500	fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe	NLgN9aF0VcNEhZC.exe

C:\Users\Admin\AppData\Local\Temp\fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe
"C:\Users\Admin\AppData\Local\Temp\fd48912df0598c550c17c022648fa3daf29263b55c4d627e1c1016423882d860.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\NLgN9aF0VcNEhZC.exe
.\NLgN9aF0VcNEhZC.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
2cb6754b826c237bbb85cc6b53cec74d

SHA1
07adf88487d04e098d56cab09a781f578438c3c6

SHA256
66142a3d39c73e39d0274cd0282f5f1464ebe8787c194d910d40ee255a6571f1

SHA512
c16e91ae3ae264cea4877d45e350af370b8ed68cd385c8fee740c2139493778c7b415ac1abc9c51bc99dc5a4b6811ac11015f610695fef7ff210f4485ee3a945

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
30b772a25dd7822a53f4d3eb877787f6

SHA1
7dcb701f5c56a7fe7a01eda2902b8955553c3409

SHA256
c44b577e349f21def49567da7cebf37cf053e4fe0bf8b4b42442232b2e90cdec

SHA512
cb764b1344b31f64b9679ddbda3b0ff24c5d971e1efd3aba202cc71a2b8948d3ba2318d0503f0bd61ed244ae4a6e5128c494c328903a8eda7424326967e011bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\[email protected]\install.rdf
Filesize
595B

MD5
55d0d1dc062c62597a8bf0d03cb42e99

SHA1
671620edb621c3af573274af44f7014b990f7aaf

SHA256
1ad74c8c97db9d18c9f95d512120bf31d229bb7cd58191afdda1bd899756820a

SHA512
62b3aef2f49dc2c9b4ef3ce60a3d623ca8e965e21a3bbcf02886b4751a94d61ff781c743c02d79375b2948dee677eecfe2e6474e844a35bb0689c2d78e53d572

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\NLgN9aF0VcNEhZC.dat
Filesize
1KB

MD5
2b4dea8d4e19c6566dc57b7a3d623803

SHA1
4ed0fd3b9f0f5e453ea0ffcf7a5697697819b2de

SHA256
ec595840550c75e056e2e7968a2e90493e90a6360a94e6786b77526526035297

SHA512
1261d7ce30184407e091bc1918797c55d6a1a007b2610213a2b2f5bc9e59dcb3def1b0750fc199ebd85db32a3f91a94be88e27c3b606699bc33c42421d6ad7ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\NLgN9aF0VcNEhZC.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\NLgN9aF0VcNEhZC.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\inijgenilmekkpemimeiemmhgfpkjbbk\FYQ.js
Filesize
6KB

MD5
4d6f2d488ea6e934ab0d3ac38b9c49e6

SHA1
01d30c93c638db651ce95c38da5fbaa259cb006b

SHA256
738f8f8b2cd92626953f4ad5367e4d0f48005a97c985bca8180986e64def91f8

SHA512
666794f68a878ac63c96e64355168ec04a0973bfe516adc37e812ee972d941a15b865f6c79bff169c6450ca2eae33aa551f6466ecea7286cf75bca22fbfdad33

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\inijgenilmekkpemimeiemmhgfpkjbbk\background.html
Filesize
140B

MD5
85ebe48415a2f5d5df2dd8a76c84e6a7

SHA1
59b02f55a9c470552ab3b207a02608ef4ffb7d41

SHA256
5339a55e9cd71352c6e6d358190a7000ca2cb04179bf0b4288d2b7799722a0a1

SHA512
ca82edb3a5c8149b0f19d503ddc22f04802534ee4af3ec16eb81594444d932c3aa1da3aa13b4937c99249658252f4a8a68436a5aac72b7f5e26b1ff4138ac968

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\inijgenilmekkpemimeiemmhgfpkjbbk\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\inijgenilmekkpemimeiemmhgfpkjbbk\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS101D.tmp\inijgenilmekkpemimeiemmhgfpkjbbk\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4688-132-0x0000000000000000-mapping.dmp

Download