Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:24
Static task
static1
Behavioral task
behavioral1
Sample
c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe
Resource
win7-20220812-en
General
-
Target
c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe
-
Size
931KB
-
MD5
cde9b04cbe50fb6e5ae49711ffb61ebb
-
SHA1
a58a9c0cf3dda07e37d27235a59f47b7c9349354
-
SHA256
c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e
-
SHA512
e6b2f4ffa9cc16ed462cce289aa0f23b3670c82f060028ea22d5d9685aad807674cf786afea613118e45de019eddc74f263abbbe72707ee6b9d7b577c1006d16
-
SSDEEP
24576:h1OYdaORCZ/iWCvu/2sWsJA/jlt+DHhsi:h1Os/CpYO/dJJDHhsi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
EF4PEA6AUJngUed.exepid process 1168 EF4PEA6AUJngUed.exe -
Loads dropped DLL 1 IoCs
Processes:
c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exepid process 1684 c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
EF4PEA6AUJngUed.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bikgaajbbpbemonmolbilkfjemjdneal\2.0\manifest.json EF4PEA6AUJngUed.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bikgaajbbpbemonmolbilkfjemjdneal\2.0\manifest.json EF4PEA6AUJngUed.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bikgaajbbpbemonmolbilkfjemjdneal\2.0\manifest.json EF4PEA6AUJngUed.exe -
Drops file in System32 directory 4 IoCs
Processes:
EF4PEA6AUJngUed.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy EF4PEA6AUJngUed.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini EF4PEA6AUJngUed.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol EF4PEA6AUJngUed.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI EF4PEA6AUJngUed.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
EF4PEA6AUJngUed.exepid process 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe 1168 EF4PEA6AUJngUed.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
EF4PEA6AUJngUed.exedescription pid process Token: SeDebugPrivilege 1168 EF4PEA6AUJngUed.exe Token: SeDebugPrivilege 1168 EF4PEA6AUJngUed.exe Token: SeDebugPrivilege 1168 EF4PEA6AUJngUed.exe Token: SeDebugPrivilege 1168 EF4PEA6AUJngUed.exe Token: SeDebugPrivilege 1168 EF4PEA6AUJngUed.exe Token: SeDebugPrivilege 1168 EF4PEA6AUJngUed.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exedescription pid process target process PID 1684 wrote to memory of 1168 1684 c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe EF4PEA6AUJngUed.exe PID 1684 wrote to memory of 1168 1684 c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe EF4PEA6AUJngUed.exe PID 1684 wrote to memory of 1168 1684 c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe EF4PEA6AUJngUed.exe PID 1684 wrote to memory of 1168 1684 c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe EF4PEA6AUJngUed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe"C:\Users\Admin\AppData\Local\Temp\c7fdf72863d8e906e99e367563985a98e46ecd9443f374fb62f8361f0fa9aa1e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\EF4PEA6AUJngUed.exe.\EF4PEA6AUJngUed.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\EF4PEA6AUJngUed.datFilesize
1KB
MD5843187e2ea4df39cc8fd12c03adc14ea
SHA197c1c7c9755c4ec2ed1114f1e651203f1e9d136c
SHA2560151f88e9506aa48e10d7d774bd50885c6cd7f83f5c16ebb571fc3aa320c3561
SHA51226e496882846b644b19caf745df4499c2c69fbf65f5766ec5fd1cfafff3316f613230e11ebfd90cd2c639b05e25e60191b662c1e08558a73760152316de14c42
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\EF4PEA6AUJngUed.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\bikgaajbbpbemonmolbilkfjemjdneal\Dyspq9sERc.jsFilesize
6KB
MD5399be3113e66da8c6140c561f5a0b14c
SHA1d2917227986b365656494f3988caaf2285128bf3
SHA2565aee683f4f599f86555ba6c4deec0db696fa0b6ab2783a8a9509a814b3688637
SHA512bb572a9d6da2f159a9c69036af5b3c79df325b00539b7ea43596dccf231bb1225a38fcb68c07a62998c5daef04eeaea4db48d5135e072710ca4e44325be862e4
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\bikgaajbbpbemonmolbilkfjemjdneal\background.htmlFilesize
147B
MD5ffcad2b016e09e2cd8eb521b786cb881
SHA19f4815af69d5fbef0629cb0b5c1bbd8838b935e2
SHA2563b4a08d0d9269f6c969801fd971b6ffb36cd5b1fa7135d803be1610463bc7340
SHA512a1e98fce20b9c5c4cbcd447a4c76b558284b882b735bbd5d0610632482b12095b57b917f8b95147d6e85f7a336fa97acbb8c1f1a5763823fdb80dd2459cafa0c
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\bikgaajbbpbemonmolbilkfjemjdneal\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\bikgaajbbpbemonmolbilkfjemjdneal\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\bikgaajbbpbemonmolbilkfjemjdneal\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\[email protected]\chrome.manifestFilesize
35B
MD55d6e682e20e476145cca8900d36c4668
SHA1f561344646cca725963934b831f58d06b90c0b97
SHA25622ed7fed15d14edac6f72025681ec56ae1dac9d24ba48231a547d6f3b77015de
SHA512f21bcf56e3640f1dc77ebd5c6654a01be89ebe480e315a8c46e21a873354584c974f272b79f52af3963fc6f3c6891d19ae2e990ee9c3ded3da617f0888ec4c58
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5e958d3bb2080c347f570a5b009826de7
SHA171986d9cc809aff5b65082d99e092b5d0ff9c48d
SHA256886c97f7420939216b69bc0eb0cdff039e02a0e48bd930ae1428b300c12929a3
SHA5124574b48ee844a833c1edb33238a49b04051b391f99691a1287d7e09187dff6ac624507cfc77356d1cc853f3ea51e5266d575c608f67f6601912b921c77cc866a
-
C:\Users\Admin\AppData\Local\Temp\7zS648.tmp\[email protected]\install.rdfFilesize
593B
MD574163bf567360a1e13c9d837abd2a537
SHA1bf6252c48b2b80c33cd36d145a872a0097dbd75e
SHA256db0ea18263a197f7470eb25090803373e784e39c986d81ffc2e8b8c477dba0cd
SHA51239dbff5b5b9b70b74b406d0c7c722a4bc2ba8f677b65ce5d73ced36d4d9f792f0828b6a2c9a707011b496b51a1a41fcbf667aca939f53339a9ac51db92af3bab
-
\Users\Admin\AppData\Local\Temp\7zS648.tmp\EF4PEA6AUJngUed.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1168-56-0x0000000000000000-mapping.dmp
-
memory/1684-54-0x0000000076401000-0x0000000076403000-memory.dmpFilesize
8KB