Analysis

  • max time kernel
    195s
  • max time network
    242s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 17:00

General

  • Target

    f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60.exe

  • Size

    4.4MB

  • MD5

    4502245e0b02ae96258226d99721d23c

  • SHA1

    83d8858cfbf232acd0debfed4892623a996610db

  • SHA256

    f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60

  • SHA512

    3003fce276eb5a7e717923e1874d9aaac884f4235cddb87bfa4b8fd8565f9a85aac04d51961e52a97c2a7bc7029e2dca28fb3b29fd479dcdddc95ba4596be785

  • SSDEEP

    98304:PWs4acUedFHuI/jHlahs/cD7HjaeffUSG7TPU:r53eNjHla5aeff/G7L

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60.exe
    "C:\Users\Admin\AppData\Local\Temp\f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60.exe"
    1⤵
    • Loads dropped DLL
    • Drops Chrome extension
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4000
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:3108
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:4872
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:1640

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.dat

        Filesize

        4KB

        MD5

        e01e74ac2374fedccc96c8ece2ff7924

        SHA1

        30ffc580453f9bd03040153c5657a81eac99142d

        SHA256

        896befb661b359b49a4a9853920e93841bf2e2818c7551edf238d7057bcab6c8

        SHA512

        c02328f02bf207aebed9a9e44a41ffaf2390daa2759d2ef75da7a453423e4e677c9e9b13bec5cae19274e8acea751b1973d05987a2d9d3924974c4637fec1708

      • C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.dll

        Filesize

        747KB

        MD5

        d949da968ea04ac3a7ddf0e300bb32be

        SHA1

        581d7d799c538b8e9e578cf57c420fb802d5a201

        SHA256

        5c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b

        SHA512

        fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e

      • C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.tlb

        Filesize

        3KB

        MD5

        5b503f1b4056c3d4fbf2d03f88e1adfe

        SHA1

        c8d659ea27bf0ca0bbfd46865d5796589bf9ef68

        SHA256

        231ef0fef77ab6c7fea053f64a9ce7f9e21646b868bfe391962262fc15c9bb6c

        SHA512

        229207201368d9674258389df19132070390f913aa5cc21b7567c515be5f5e0f07cdaa460d497ae355f27f00f7fc75538783d8890f6c9c0e861a7ecb8f520bdb

      • C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.x64.dll

        Filesize

        885KB

        MD5

        1a6b1013f17c1cdc6e98f82cd2568ea8

        SHA1

        c96e7bdba616743a5c05b08a342d89ed102376b0

        SHA256

        fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

        SHA512

        10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

      • C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.x64.dll

        Filesize

        885KB

        MD5

        1a6b1013f17c1cdc6e98f82cd2568ea8

        SHA1

        c96e7bdba616743a5c05b08a342d89ed102376b0

        SHA256

        fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

        SHA512

        10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

      • C:\Program Files (x86)\PriceChop\rOkEWMNm6UTZhP.x64.dll

        Filesize

        885KB

        MD5

        1a6b1013f17c1cdc6e98f82cd2568ea8

        SHA1

        c96e7bdba616743a5c05b08a342d89ed102376b0

        SHA256

        fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a

        SHA512

        10596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9

      • memory/1668-138-0x0000000000000000-mapping.dmp

      • memory/3108-141-0x0000000000000000-mapping.dmp

      • memory/4000-132-0x0000000002E80000-0x0000000002F46000-memory.dmp

        Filesize

        792KB