Analysis

  • max time kernel
    204s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 17:56

General

  • Target

    e24f58bc16b6c909d692ed99193342adcd8e85c4cb51055cbc417fe1358d478d.exe

  • Size

    4.6MB

  • MD5

    ecd6816f0ca9a5514684aa37faa00cc9

  • SHA1

    1f7a59ed6a52976d540b1c6b02548803fd7b50a2

  • SHA256

    e24f58bc16b6c909d692ed99193342adcd8e85c4cb51055cbc417fe1358d478d

  • SHA512

    153350e2a14161cfb3bee3301e1c903ff2ec6990b73a7450a3b038bf41bda051e0d9ddeac71719ee8a7384110e916de1537973e4c050f057a3498e7b65ce6874

  • SSDEEP

    98304:j7V2nX4VAgFrAkcLQ93x5wSohdQn9+K0th:j7Uz7dSoHQn9h

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e24f58bc16b6c909d692ed99193342adcd8e85c4cb51055cbc417fe1358d478d.exe
    "C:\Users\Admin\AppData\Local\Temp\e24f58bc16b6c909d692ed99193342adcd8e85c4cb51055cbc417fe1358d478d.exe"
    1⤵
    • Loads dropped DLL
    • Drops Chrome extension
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3136
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2144
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:1984
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:2248

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.dat

        Filesize

        3KB

        MD5

        e8c4d6a4fa4029dae5dea072a3705553

        SHA1

        1ddee6f44dfd6c64b685f93f1fed01b9e6cf35e2

        SHA256

        68e3c4fd87ac4e25e5558acc19268378b779fb5bfa420c6466ff309931b68702

        SHA512

        6da009faddcd36d5ef6791d9fb4acdd299c28f124a7f1f014dea0fb87225d7afed3d294ef0395bc73725dd504fbb4b2139cfa9d3a648caa5e8ccca181f932c43

      • C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.dll

        Filesize

        742KB

        MD5

        b2f3ebabeb25be4e941895456ae0d6e9

        SHA1

        833922df77d5c58c7e68fb171178fb491f1f60b7

        SHA256

        19bae6d31d981507e7be9bfcc8933efcc3f6d6000631a2dd91d11925aee36a5d

        SHA512

        8f49b6ede7bc6476ec69be8196dbb02355615032219d2a6d18ab598b73ffa43afe0220a59089481a6ac27b82dcb49624f38e38963af147daedb8e25206077940

      • C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.tlb

        Filesize

        3KB

        MD5

        6c6e0a2c7b4bb543edd13783d1cc76dc

        SHA1

        e9a430273efcfdfc6770f19d7ffc8b0e888b1c66

        SHA256

        cd433df927506850bba50c28426192814a1fad6a0d02d1e84676c507c0cb0a14

        SHA512

        9ca0c224fdaf8a67649d1f199072f6e2bbb1fa956ea0b0998642571d252d6bf300c7781be1a7b5bc9a62b9c98febe02083a8ca2edc8b8c3f29cca4da32f77995

      • C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.x64.dll

        Filesize

        876KB

        MD5

        afd15380f9d387edaeb3a03ba10cb88d

        SHA1

        c20cb03dccf9b960b7131a829ffa04640866cde6

        SHA256

        ff9461a529ded107e677afe757609b2c0202fa9a3f76976acff4950959e99555

        SHA512

        c5fdd58478c980af3c1bde9754b2874a7a0db11dca5dcba8ed028d6039444dd7dd088e465b12b768a9ade4131438c330b22456e1fa9949f2e82b8c93bbb49762

      • C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.x64.dll

        Filesize

        876KB

        MD5

        afd15380f9d387edaeb3a03ba10cb88d

        SHA1

        c20cb03dccf9b960b7131a829ffa04640866cde6

        SHA256

        ff9461a529ded107e677afe757609b2c0202fa9a3f76976acff4950959e99555

        SHA512

        c5fdd58478c980af3c1bde9754b2874a7a0db11dca5dcba8ed028d6039444dd7dd088e465b12b768a9ade4131438c330b22456e1fa9949f2e82b8c93bbb49762

      • C:\Program Files (x86)\PriceLess\a6ZShNMYAwloQC.x64.dll

        Filesize

        876KB

        MD5

        afd15380f9d387edaeb3a03ba10cb88d

        SHA1

        c20cb03dccf9b960b7131a829ffa04640866cde6

        SHA256

        ff9461a529ded107e677afe757609b2c0202fa9a3f76976acff4950959e99555

        SHA512

        c5fdd58478c980af3c1bde9754b2874a7a0db11dca5dcba8ed028d6039444dd7dd088e465b12b768a9ade4131438c330b22456e1fa9949f2e82b8c93bbb49762

      • memory/2144-141-0x0000000000000000-mapping.dmp

      • memory/3136-132-0x0000000003070000-0x0000000003138000-memory.dmp

        Filesize

        800KB

      • memory/3460-138-0x0000000000000000-mapping.dmp