c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe
Size

931KB
MD5

1607a1e1846dd57ddeb03c4e9ad9119a
SHA1

14aaa5798edad436bebbca9dacb62c8f1d602c76
SHA256

c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512
SHA512

62a846fe7c9a98056a2dba51615484e0563f9eb8c3da9adb419b35d50358c40b5f5eb3f6a5547a4444ed6074a803b243c910c090304112762c58ac1be43c5f18
SSDEEP

24576:h1OYdaOcCZ/iWCvu/2sWsJA/jlt+DHhsl:h1OsmCpYO/dJJDHhsl

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ptbio2HF7GZk6N6.exe

pid process

1548 ptbio2HF7GZk6N6.exe
Loads dropped DLL 1 IoCs

Processes:

c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe

pid process

1132 c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1548	ptbio2HF7GZk6N6.exe

pid	process
1132	c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe

Drops Chrome extension 3 IoCs

Processes:

ptbio2HF7GZk6N6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldmmdfjjahdlcfnnpkpfbleadofkicfa\1.3\manifest.json	ptbio2HF7GZk6N6.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldmmdfjjahdlcfnnpkpfbleadofkicfa\1.3\manifest.json	ptbio2HF7GZk6N6.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldmmdfjjahdlcfnnpkpfbleadofkicfa\1.3\manifest.json	ptbio2HF7GZk6N6.exe

Drops file in System32 directory 4 IoCs

Processes:

ptbio2HF7GZk6N6.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	ptbio2HF7GZk6N6.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ptbio2HF7GZk6N6.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ptbio2HF7GZk6N6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ptbio2HF7GZk6N6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ptbio2HF7GZk6N6.exe

pid process

1548 ptbio2HF7GZk6N6.exe
1548 ptbio2HF7GZk6N6.exe
1548 ptbio2HF7GZk6N6.exe
1548 ptbio2HF7GZk6N6.exe

pid	process
1548	ptbio2HF7GZk6N6.exe
1548	ptbio2HF7GZk6N6.exe
1548	ptbio2HF7GZk6N6.exe
1548	ptbio2HF7GZk6N6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe

description	pid	process	target process
PID 1132 wrote to memory of 1548	1132	c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe	ptbio2HF7GZk6N6.exe
PID 1132 wrote to memory of 1548	1132	c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe	ptbio2HF7GZk6N6.exe
PID 1132 wrote to memory of 1548	1132	c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe	ptbio2HF7GZk6N6.exe
PID 1132 wrote to memory of 1548	1132	c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe	ptbio2HF7GZk6N6.exe

C:\Users\Admin\AppData\Local\Temp\c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe
"C:\Users\Admin\AppData\Local\Temp\c8fafb47bd1c15acfd7c80aec45a60786a0d4c8ff54ac72bebd8232097f08512.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132

C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ptbio2HF7GZk6N6.exe
.\ptbio2HF7GZk6N6.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ldmmdfjjahdlcfnnpkpfbleadofkicfa\U.js
Filesize
6KB

MD5
2fbfcd323dc227101b5f3f65d684c3a4

SHA1
84d274b164edf1cea2e96c5525c9bca8238e39a0

SHA256
92528c919b33b1c3b018f659375b6e41b9f612f0c3e823c2bfe3ce0f27096e9a

SHA512
70e15d9a8b19f7cccdc0054656b4cae9a690075acd5be172d3802433e2b509db91e3d0be44979755a4fac263613462e339e2ca241255a4bd9cc61f6eda17667f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ldmmdfjjahdlcfnnpkpfbleadofkicfa\background.html
Filesize
138B

MD5
e1b4deb0e527b3cf57477d89855bea06

SHA1
d815c8fb55038db446043b8590737a40a7f3d809

SHA256
4250433b6b4d17673c63d7b850d0eb440fe4a6ad00baa41ca0fd1481e92d0a23

SHA512
bb06bd5b56ada66f1f93ae154e4375762cf878acafd327bea99e41d492ccedd1a7b79262bac54bbcc52494d1625de7fd74babeb495f2b74252e3831f4e1b7c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ldmmdfjjahdlcfnnpkpfbleadofkicfa\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ldmmdfjjahdlcfnnpkpfbleadofkicfa\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ldmmdfjjahdlcfnnpkpfbleadofkicfa\manifest.json
Filesize
498B

MD5
664e2884e17f23553a19eee317642194

SHA1
a28ccc088d6b6692646150f3e8f111e568723fb4

SHA256
ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

SHA512
b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ptbio2HF7GZk6N6.dat
Filesize
1KB

MD5
659055b8e194ad6ad57085d38417fe69

SHA1
75f62253dcc4e1da068a5f851046bf0896a809c3

SHA256
c07fa625753daff74e20fb71a70fb3fa698976de75ae535d0cfd5b41d4194b60

SHA512
03a93eb61d3afef5cd863bcbe6e0ae07414ab69cabfcfcfb2f54a909293849695e6872fc7824349d1d1dbf11ce91f330ed3b533cfe31a6a9b998ead8cbe32581

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ptbio2HF7GZk6N6.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
280b834ec458d34e6444fe6b6fe65629

SHA1
1cb64e1f27ad6e5a4e79975fa2ce94f6aa70130c

SHA256
45ecb249beab5e30f4bc53b62d93998448a90feb402571856555addd72d4b625

SHA512
04c8a942f6d8fda01a8090b3c4930cdbf3ad872e52af376f6a40fc23ab2ba9b4b3f5fa89b216b3d28ac73946684e9e5794ce0d76c1b31af8bac9a19bb84496a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
a3ce603c75ee02cf6b3d108adba1f29e

SHA1
03c0da06417aafae09ec0f269ac193213727d12c

SHA256
45b97fa5bcbbfb1c7d285fdd44f7de6640d551e805be51119ec8aa82ac7c5c86

SHA512
0256e650a331bbccf1595af21efc8d5d30651cd259025d53a2ab7ef3371a1ffbe5f5b3090b3fc1c007e0b0a9314e4b7a5f8dbe6e5b1187c698abd26ec58fc13c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\[email protected]\install.rdf
Filesize
594B

MD5
845917ce91f25fe1a6448f137cee3c3a

SHA1
480780f6c6f438bbd4875f1c9f2e560a4915c4ae

SHA256
2d2d379ca1b4b9e57ec2a9d1886cdd08ef953e1071b07e28af310aabc49eb081

SHA512
6258afdbadcaf1d689490b7b190af7a7bb221b7be9e213903b0dcbc0ad0b6c35d1f7565ad4f930ed7cd4fd0e0c9c78cfee5b92d3688ab1e8ac0470412e7eb1a0

Download Submit
\Users\Admin\AppData\Local\Temp\7zS33CE.tmp\ptbio2HF7GZk6N6.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1132-54-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1548-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads