Analysis
-
max time kernel
179s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:23
Static task
static1
Behavioral task
behavioral1
Sample
c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe
Resource
win7-20220812-en
General
-
Target
c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe
-
Size
931KB
-
MD5
6d532078e16c264897bdab17dc2c4287
-
SHA1
28e136123df98ddc683b76064cf72a9393682858
-
SHA256
c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04
-
SHA512
02e83de46f8abb697f0b333a7edaaa94b7c097581d9d40e3e76de3a5dc2bad4df599006050fd0255a0be0d7595770c26f229a983928d7546a2a78d85488d335e
-
SSDEEP
24576:h1OYdaObCZ/iWCvu/2sWsJA/jlt+DHhsX:h1OsFCpYO/dJJDHhsX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pQl5sf6aQILdkU5.exepid process 4832 pQl5sf6aQILdkU5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
pQl5sf6aQILdkU5.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpjalfgknpjaggloanfpcnlkpgneibg\2.0\manifest.json pQl5sf6aQILdkU5.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpjalfgknpjaggloanfpcnlkpgneibg\2.0\manifest.json pQl5sf6aQILdkU5.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpjalfgknpjaggloanfpcnlkpgneibg\2.0\manifest.json pQl5sf6aQILdkU5.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpjalfgknpjaggloanfpcnlkpgneibg\2.0\manifest.json pQl5sf6aQILdkU5.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpjalfgknpjaggloanfpcnlkpgneibg\2.0\manifest.json pQl5sf6aQILdkU5.exe -
Drops file in System32 directory 4 IoCs
Processes:
pQl5sf6aQILdkU5.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy pQl5sf6aQILdkU5.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini pQl5sf6aQILdkU5.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol pQl5sf6aQILdkU5.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI pQl5sf6aQILdkU5.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
pQl5sf6aQILdkU5.exepid process 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe 4832 pQl5sf6aQILdkU5.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
pQl5sf6aQILdkU5.exedescription pid process Token: SeDebugPrivilege 4832 pQl5sf6aQILdkU5.exe Token: SeDebugPrivilege 4832 pQl5sf6aQILdkU5.exe Token: SeDebugPrivilege 4832 pQl5sf6aQILdkU5.exe Token: SeDebugPrivilege 4832 pQl5sf6aQILdkU5.exe Token: SeDebugPrivilege 4832 pQl5sf6aQILdkU5.exe Token: SeDebugPrivilege 4832 pQl5sf6aQILdkU5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exedescription pid process target process PID 4884 wrote to memory of 4832 4884 c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe pQl5sf6aQILdkU5.exe PID 4884 wrote to memory of 4832 4884 c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe pQl5sf6aQILdkU5.exe PID 4884 wrote to memory of 4832 4884 c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe pQl5sf6aQILdkU5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe"C:\Users\Admin\AppData\Local\Temp\c8b5bac57bfddba7e94802f1ced7763b11781107b9ff281025499fccd3488c04.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\pQl5sf6aQILdkU5.exe.\pQl5sf6aQILdkU5.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\[email protected]\chrome.manifestFilesize
35B
MD5e7a6872fa16b6245d21b546b66b4efe7
SHA112c247c33c9e7e0b11418568363452039fa94b99
SHA256f92e8b654f529b09cfeaa445731bf19b50afbc10d6a8d5f8fcea9302aef6411b
SHA51263aa99911cd076b46edbdc6d83c903197cabf5619ad9fc686d26552f7d51877680fcb964ef79a6dd368a49ace3c41b68f1bdd50477b25e73ffbaf79d9e3d9667
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5199997445d0a243a3e9b996859de2275
SHA1f55ec2e9ff6637b14d6516d0ca5baf20e00540ff
SHA256932f68c1370892ce2914f9e16590c2098d772afbfc4b1d465b621dab879fc68a
SHA512df50834dca8357cf719b8f8e576ce611949d7295058afb441504c1fe622595e21720b7a86eb0632c4b2e4da721012b41859882c4c38f19a83f573f26173d110c
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\[email protected]\install.rdfFilesize
594B
MD552d24137ade750153017f1292d54278b
SHA13b980325170033e97f1b04654a346e93789449db
SHA2561e2eecd244f8658c44cae0ec96ee5e2e682748bebf1e93e676c271acc6136f7f
SHA512e2e1659441a80d4d804f1fbe98478ed907e92d87b087265f2115dfa35585eb1aab670c39a0aa362fdbb1bdeb1c22e2bda0de0b07711159d2ff1d13ecc9ac4e2a
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\ojpjalfgknpjaggloanfpcnlkpgneibg\LJK47zyTGM.jsFilesize
6KB
MD5f6f6ebbcca47a63f467f56ca7ad84cfa
SHA185b980e5acdde1eb5835d926a1fc9ad046eaca4a
SHA256bc8f543b698baca1d72e3a45e50281a3d63fb6e1efe2811b89dccff7faf1be95
SHA512ddc511143efdfa4f47baab5fd45a811a775fb019ef31ae34181fe5a1d35b98731780bc8afd1b1229367bc8c823d37aa0d0217157451310213dea82a921420109
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\ojpjalfgknpjaggloanfpcnlkpgneibg\background.htmlFilesize
147B
MD506f9355b8159e50be9599d9f894b3b99
SHA12aa5b719450b80a1eddc0df848affd77b09bdb1a
SHA25660fde9226702834c9fefe500f7ce00b46095d5eb24de95eaade2e16205d1e6d1
SHA51258a0c22d9c356e5040939b60883f11121ce2f9719fe1dc0426cb05bcaed76f93b2808fd999567f64218b8b53243e44ac186773536399dad30b9bbe956a6b2d4b
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\ojpjalfgknpjaggloanfpcnlkpgneibg\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\ojpjalfgknpjaggloanfpcnlkpgneibg\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\ojpjalfgknpjaggloanfpcnlkpgneibg\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\pQl5sf6aQILdkU5.datFilesize
1KB
MD56c31a7464b46122898f8fd0efa561ba3
SHA1c1c0c6f2a1bc226991fd655f1da9c679bf73be5f
SHA2566de08b97d61d6c0e417c29b75a2c971656ebdae0d8ecda52367e1cd34509d3f1
SHA5128cb24cbf56cf13080c8668527c6bbb3cfdb0dcd83ff00cc86af6e888f821056179d9735d651b80ff5838bd8dfaa63940e0ac45e44e2b4eb6c924c84a9f70b6f7
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\pQl5sf6aQILdkU5.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSBB8.tmp\pQl5sf6aQILdkU5.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/4832-132-0x0000000000000000-mapping.dmp