Analysis
-
max time kernel
249s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe
Resource
win7-20221111-en
General
-
Target
c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe
-
Size
2.5MB
-
MD5
37559264e3828d0c141daaef399905bd
-
SHA1
9b9d94bcc07f7fa3fb6c79a3e9f4334b13a3af31
-
SHA256
c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc
-
SHA512
a55bc9432f30569c5a4d323085d38fd517f510aa8cfbd63bf505c2554c07f0f7f7a9e50e197562b2d2cb8870dfb9d7887d5115beb7df5c70e0575ccdc6fc192e
-
SSDEEP
49152:h1OsfyDFXmj+BHBALGk7GNIgSDjjQkzYznJKOZaB/IsxM:h1Oe0JSqALGkqaDj7M
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
abxrS14Z4iyksaS.exepid process 780 abxrS14Z4iyksaS.exe -
Loads dropped DLL 4 IoCs
Processes:
c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exeabxrS14Z4iyksaS.exeregsvr32.exeregsvr32.exepid process 976 c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe 780 abxrS14Z4iyksaS.exe 1384 regsvr32.exe 752 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
abxrS14Z4iyksaS.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckjeagmmnnjehcjienjjkpoahnoaapk\2.0\manifest.json abxrS14Z4iyksaS.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckjeagmmnnjehcjienjjkpoahnoaapk\2.0\manifest.json abxrS14Z4iyksaS.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckjeagmmnnjehcjienjjkpoahnoaapk\2.0\manifest.json abxrS14Z4iyksaS.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
abxrS14Z4iyksaS.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} abxrS14Z4iyksaS.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} abxrS14Z4iyksaS.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects abxrS14Z4iyksaS.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} abxrS14Z4iyksaS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ abxrS14Z4iyksaS.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
abxrS14Z4iyksaS.exedescription ioc process File opened for modification C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.dll abxrS14Z4iyksaS.exe File created C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.tlb abxrS14Z4iyksaS.exe File opened for modification C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.tlb abxrS14Z4iyksaS.exe File created C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.dat abxrS14Z4iyksaS.exe File opened for modification C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.dat abxrS14Z4iyksaS.exe File created C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dll abxrS14Z4iyksaS.exe File opened for modification C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dll abxrS14Z4iyksaS.exe File created C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.dll abxrS14Z4iyksaS.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
abxrS14Z4iyksaS.exepid process 780 abxrS14Z4iyksaS.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exeabxrS14Z4iyksaS.exeregsvr32.exedescription pid process target process PID 976 wrote to memory of 780 976 c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe abxrS14Z4iyksaS.exe PID 976 wrote to memory of 780 976 c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe abxrS14Z4iyksaS.exe PID 976 wrote to memory of 780 976 c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe abxrS14Z4iyksaS.exe PID 976 wrote to memory of 780 976 c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe abxrS14Z4iyksaS.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 780 wrote to memory of 1384 780 abxrS14Z4iyksaS.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe PID 1384 wrote to memory of 752 1384 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe"C:\Users\Admin\AppData\Local\Temp\c8b97599426311f10c28208131cc06721b92ccd4c99c03caf94dfa4014eed7bc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\abxrS14Z4iyksaS.exe.\abxrS14Z4iyksaS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.datFilesize
6KB
MD5fedb89e0665ca7a23711fd680e615cb7
SHA1fa889ee212f361c63529d6005812bf4bafacbf44
SHA2564dae59240f6d5f748cd29a24e4bb1bfeec78c8cbab82ceba5fa84d3c0c482f6f
SHA512bbe224239fcbfbcee0659fa7b7335e8e45a386318f7327cfb3921e30c7f97b9b8076cdd5c07d9a706a3661b7dcd7592850cd46c876ace534305b646228c43435
-
C:\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dllFilesize
886KB
MD5eadda36c5638e64e055ca60e50caf427
SHA1822ae0491b2897790cb3e10920836e2ea40696e1
SHA256419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff
SHA51260fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\[email protected]\chrome.manifestFilesize
35B
MD5b9a791673785f4e9bc7d86ba36ff7266
SHA18a164cae32ae89ef15c7b92de49ae0d30948adc9
SHA25656cb204c73c311f43e1b0535ebb48e26d235cdf67f7ea2f5d033dc408a1d51e3
SHA512ce10b717441b8ecfcfc25711acc48bab776bddf2c0d4951039ffe436e83e558add2d83fefabae30289f5df7e766cf63f15988cb6e7f28adf455133591b879b50
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\[email protected]\content\bg.jsFilesize
7KB
MD59eb148434f79fb7d0a39035d274bd224
SHA1b5009e6f08afa66df9e760f9774bf7bb441f671e
SHA256ee9f8c1a265ed97de440882fc9b40a138da387b152c876058cd72e7e0121dea8
SHA5127dc2a211d0d16e565f1ff0a7e6663b0eef7d65a60bb859d25bc5420d4cbd6b5c58e667beb6b3a7fb6e4ccf1e0c0c0a65dcd34768bb29508318a7f246998111a5
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\[email protected]\install.rdfFilesize
591B
MD59a83725318f5d6fcd06f11262233a7c9
SHA13daf6909f4314075df6543224bf245a0f392a18c
SHA25627b8a6f3089b2ec694f30e1cb643b764984668ed98a3df4ce055172c13a629a0
SHA5124181cb596a7884a6dd2ac03bc0c6bd8431a162ce3b82952f3b6dd7ff411553ac1f000935872b0059d548427560201c23725853a692849db63c42e32b5a2c9d0d
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\CoozCyrikPlTSC.dllFilesize
749KB
MD505636af3aa9a36a4a1df7560231b520c
SHA194b0fb3246f9d757a44cc80401bab6720f7f5fb3
SHA2562c8c222a335b7872c49a0a0185d5cbf29481c8364e1d5d822afa532cfa77ee10
SHA512e8d8e47faf9d357cfae6c8e515426787111b2c4602390d7cc1eda04485a436ca7013c89061887fe45da2566c5dd2e1e04599af270062379b37444985d1f1d07c
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\CoozCyrikPlTSC.tlbFilesize
3KB
MD5aafd1d71b2778cd2369e1a2d7e7166d1
SHA1f6505a389d7e2be9d3ccc3ea4e052abc338fcbb5
SHA256b3772533d10176e84e6b87269bb0ab4dd783f34baa17eb2a7ad42078a2203e1c
SHA512df4ef691872946fb4bfebc6ce3699f56fc4c5846c1a8de6b16296717ef4f41b8e5b32c43e8dd56fe46731a91da93684889e78d42a92fa37eb38622d1d71353a0
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\CoozCyrikPlTSC.x64.dllFilesize
886KB
MD5eadda36c5638e64e055ca60e50caf427
SHA1822ae0491b2897790cb3e10920836e2ea40696e1
SHA256419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff
SHA51260fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\abxrS14Z4iyksaS.datFilesize
6KB
MD5fedb89e0665ca7a23711fd680e615cb7
SHA1fa889ee212f361c63529d6005812bf4bafacbf44
SHA2564dae59240f6d5f748cd29a24e4bb1bfeec78c8cbab82ceba5fa84d3c0c482f6f
SHA512bbe224239fcbfbcee0659fa7b7335e8e45a386318f7327cfb3921e30c7f97b9b8076cdd5c07d9a706a3661b7dcd7592850cd46c876ace534305b646228c43435
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\abxrS14Z4iyksaS.exeFilesize
769KB
MD5926d03f373e2f0d6ecf16e30c941ad60
SHA1b5caf80c04b62525774f66262ce6b1ebeaa19315
SHA256b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847
SHA5126aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\abxrS14Z4iyksaS.exeFilesize
769KB
MD5926d03f373e2f0d6ecf16e30c941ad60
SHA1b5caf80c04b62525774f66262ce6b1ebeaa19315
SHA256b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847
SHA5126aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\nckjeagmmnnjehcjienjjkpoahnoaapk\RCzSi.jsFilesize
5KB
MD53d37b11b989aaf33e0f6c84cc6e16d04
SHA167015e6fc33fd5dea0765e4f67beb64fea11904f
SHA2561b7cdf4fefd5535baace835d2c0682214b4c2bf9bd0500a552c3dab1db6164b4
SHA512b95cb426be96a565fd614b5cb36249a380c7b1cd368a74ee32c975ba509a70b25c07eeb2d2f1d0ba01be657693aef1b958ab34e902fffdfe95e3a96aa757b9bb
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\nckjeagmmnnjehcjienjjkpoahnoaapk\background.htmlFilesize
142B
MD57242a3664fef2162be06a68a5d1e0595
SHA197c8c08e7da688dadb0de2cbb76ace88de267371
SHA25606e9250d660c67632d9eeee2c69558ecbbc4a60396dce8cab4c7ef250ea8febe
SHA51234e771ff6e3272be3ad81b04ba994c0362c686f507620f9d3468c6bf4393cd47dd11eb508ea7cb3416f5dc2f8fa84aff025cabe28c57292f8416dd198902fd32
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\nckjeagmmnnjehcjienjjkpoahnoaapk\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\nckjeagmmnnjehcjienjjkpoahnoaapk\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\nckjeagmmnnjehcjienjjkpoahnoaapk\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Program Files (x86)\GoSave\CoozCyrikPlTSC.dllFilesize
749KB
MD505636af3aa9a36a4a1df7560231b520c
SHA194b0fb3246f9d757a44cc80401bab6720f7f5fb3
SHA2562c8c222a335b7872c49a0a0185d5cbf29481c8364e1d5d822afa532cfa77ee10
SHA512e8d8e47faf9d357cfae6c8e515426787111b2c4602390d7cc1eda04485a436ca7013c89061887fe45da2566c5dd2e1e04599af270062379b37444985d1f1d07c
-
\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dllFilesize
886KB
MD5eadda36c5638e64e055ca60e50caf427
SHA1822ae0491b2897790cb3e10920836e2ea40696e1
SHA256419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff
SHA51260fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2
-
\Program Files (x86)\GoSave\CoozCyrikPlTSC.x64.dllFilesize
886KB
MD5eadda36c5638e64e055ca60e50caf427
SHA1822ae0491b2897790cb3e10920836e2ea40696e1
SHA256419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff
SHA51260fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2
-
\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\abxrS14Z4iyksaS.exeFilesize
769KB
MD5926d03f373e2f0d6ecf16e30c941ad60
SHA1b5caf80c04b62525774f66262ce6b1ebeaa19315
SHA256b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847
SHA5126aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0
-
memory/752-77-0x0000000000000000-mapping.dmp
-
memory/752-78-0x000007FEFC311000-0x000007FEFC313000-memory.dmpFilesize
8KB
-
memory/780-56-0x0000000000000000-mapping.dmp
-
memory/976-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1384-73-0x0000000000000000-mapping.dmp