c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb

Analysis

max time kernel
117s
max time network
219s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe
Size

931KB
MD5

0a5db531ed3cd492bcd7fa6ee5549b28
SHA1

09f0ce82d767f3095736cb1df23f10c58dc5610e
SHA256

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb
SHA512

ae649d0e6ab5905f0bd635325bad65cbd20de02ea838473d49cfcc3b1e71095e0985223733d2475a7ce754b49d1f8e1a8b98f2bb3d98482a22a71b04084f6dbf
SSDEEP

24576:h1OYdaO0CZ/iWCvu/2sWsJA/jlt+DHhsd:h1OsKCpYO/dJJDHhsd

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

pid process

564 0YpQ0HQK50VxPYg.exe
Loads dropped DLL 1 IoCs

Processes:

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe

pid process

432 c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
432	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe

Drops Chrome extension 3 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpdonhflclpfmekfpngadjcfpahibeed\2.0\manifest.json	0YpQ0HQK50VxPYg.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpdonhflclpfmekfpngadjcfpahibeed\2.0\manifest.json	0YpQ0HQK50VxPYg.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpdonhflclpfmekfpngadjcfpahibeed\2.0\manifest.json	0YpQ0HQK50VxPYg.exe

Drops file in System32 directory 4 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	0YpQ0HQK50VxPYg.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	0YpQ0HQK50VxPYg.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	0YpQ0HQK50VxPYg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	0YpQ0HQK50VxPYg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

pid	process
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe
564	0YpQ0HQK50VxPYg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

description	pid	process
Token: SeDebugPrivilege	564	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	564	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	564	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	564	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	564	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	564	0YpQ0HQK50VxPYg.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe

description	pid	process	target process
PID 432 wrote to memory of 564	432	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe
PID 432 wrote to memory of 564	432	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe
PID 432 wrote to memory of 564	432	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe
PID 432 wrote to memory of 564	432	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe

C:\Users\Admin\AppData\Local\Temp\c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe
"C:\Users\Admin\AppData\Local\Temp\c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:432

C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\0YpQ0HQK50VxPYg.exe
.\0YpQ0HQK50VxPYg.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\0YpQ0HQK50VxPYg.dat
Filesize
1KB

MD5
37cc0b131f1130fa7c301ccaa1a38f45

SHA1
0ab081c3b72b5db3d65442c580a5924333113799

SHA256
ff8b25306eabe58e360723d312e4a88afaefd6aeb7bf965dbbc266371beb4295

SHA512
c06133d5e5dbe4a93c4d1b9ba85493ce6ed9c0985f31af79fb563ddb70449470b767bd7a7ba44d789e8a68753f820fbcdd64837fd080cf3105f7da326b1718c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\0YpQ0HQK50VxPYg.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\mpdonhflclpfmekfpngadjcfpahibeed\Z6I5H.js
Filesize
6KB

MD5
31acc20e72931afc3920067ed339b585

SHA1
0eaac63d71e8c58e493aff4ddf4b6f15911a102c

SHA256
5cf1d06892b9a3172800e180265322e3050a618ef367adc15969786bcc59676d

SHA512
6f9f6ebf281e7661dac12affbc5d2583dfbef70b061b0e154f4d9277c5d8b2124a4e0de86ed899f0c09f62edbc4409bb2f7ff30f24bd0e65cf5a03cf1cb7a459

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\mpdonhflclpfmekfpngadjcfpahibeed\background.html
Filesize
142B

MD5
bedf9b0d957793a2961f96ed2cd67c40

SHA1
b4c66dc565db307d251df331293dbc42936d5fa3

SHA256
d9c4960eddad7eaaa3ea0722ea2bfeb8a55024ced128e0f70f79fab2cdff98f9

SHA512
08be4c7b10c93f2a5a2c0c645b9dff285af233ab3b9332efbd5e0a8ce2f97246b1ac066b94a2e006908df0c8adb3f6ed6d84b529c7bdec37e945de666ac02ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\mpdonhflclpfmekfpngadjcfpahibeed\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\mpdonhflclpfmekfpngadjcfpahibeed\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\mpdonhflclpfmekfpngadjcfpahibeed\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
d164049b32ba784a21eba74a82fc49ce

SHA1
7ebaad2cd5dfcddfdc7f10eaf069b61e8215e1e4

SHA256
8ca0d4d30afd91696ad220ebeb1109ad8e6f549c9b6c5c761c4df938d1e3c6b5

SHA512
b0db9c0277874854ce548c89f74825ff82e462c97c3601a5faa1105a68a430b6d34be20941fd2d9f4d84e5d6c832d31f8b190d252cb5781441c5a0f26e7e441c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
422309be5629d97b6ba0a22336d52d58

SHA1
f7aa15f72b6fd69320743e7d25b7313a78ae8b57

SHA256
48abd2688b4ad4b1fae38d0b127521d45f6e499c8a3234dbb224330e9927e523

SHA512
ea72690d198e8ff4a3ac2b5714af4860d28aaa3d380a4b961ebc45c4e1acb15d8d33896b65c1a67c9d9625f45d2303afe31823d2488077a607d8a8418764a94f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\[email protected]\install.rdf
Filesize
594B

MD5
0cb5b43892ff9d01d304e6a6417e1dc0

SHA1
5126d3c279c8c14bafb84384a71ac4cb5c98f5d7

SHA256
4f647848253014dc17fc9db985887af7e9c1b84e4b77f82135be051cd5f76f81

SHA512
5025aba82b1492fc68b50ab1e9342c8839b3a52d3672bd09e10dd9c06e941fb4289708785e6b46b79b71b41c0d52a5537433ebdbcd0bf835184094ab487fbd1f

Download Submit
\Users\Admin\AppData\Local\Temp\7zS9E05.tmp\0YpQ0HQK50VxPYg.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/432-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/564-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads