c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe
Size

931KB
MD5

15a7864883c452da5aa2426c7934bf16
SHA1

0480a62361255da0c550912e6fe4ffa3e9e0021d
SHA256

c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71
SHA512

d24204300e6f7ab4c8ccc3614db44b20ec02b69cf5273e897e84ae176f53adc1a9e54532f6ae2fb9f991d5086f48a8f7fe4a624ea473f6558d988961b223863b
SSDEEP

24576:h1OYdaOWCZ/iWCvu/2sWsJA/jlt+DHhsR:h1OscCpYO/dJJDHhsR

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vHQIxrurJ7eimn9.exe

pid process

4740 vHQIxrurJ7eimn9.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

vHQIxrurJ7eimn9.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ameclcndlcaadbompopmoapcjhhmfcjd\2.0\manifest.json	vHQIxrurJ7eimn9.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ameclcndlcaadbompopmoapcjhhmfcjd\2.0\manifest.json	vHQIxrurJ7eimn9.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ameclcndlcaadbompopmoapcjhhmfcjd\2.0\manifest.json	vHQIxrurJ7eimn9.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ameclcndlcaadbompopmoapcjhhmfcjd\2.0\manifest.json	vHQIxrurJ7eimn9.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ameclcndlcaadbompopmoapcjhhmfcjd\2.0\manifest.json	vHQIxrurJ7eimn9.exe

Drops file in System32 directory 4 IoCs

Processes:

vHQIxrurJ7eimn9.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	vHQIxrurJ7eimn9.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	vHQIxrurJ7eimn9.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	vHQIxrurJ7eimn9.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	vHQIxrurJ7eimn9.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

vHQIxrurJ7eimn9.exe

pid	process
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe
4740	vHQIxrurJ7eimn9.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

vHQIxrurJ7eimn9.exe

description	pid	process
Token: SeDebugPrivilege	4740	vHQIxrurJ7eimn9.exe
Token: SeDebugPrivilege	4740	vHQIxrurJ7eimn9.exe
Token: SeDebugPrivilege	4740	vHQIxrurJ7eimn9.exe
Token: SeDebugPrivilege	4740	vHQIxrurJ7eimn9.exe
Token: SeDebugPrivilege	4740	vHQIxrurJ7eimn9.exe
Token: SeDebugPrivilege	4740	vHQIxrurJ7eimn9.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe

description	pid	process	target process
PID 4748 wrote to memory of 4740	4748	c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe	vHQIxrurJ7eimn9.exe
PID 4748 wrote to memory of 4740	4748	c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe	vHQIxrurJ7eimn9.exe
PID 4748 wrote to memory of 4740	4748	c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe	vHQIxrurJ7eimn9.exe

C:\Users\Admin\AppData\Local\Temp\c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe
"C:\Users\Admin\AppData\Local\Temp\c79eb5c39ba008de9a155ff5d9249362b5d83f4d71113d8d945fd1797dc2cd71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\vHQIxrurJ7eimn9.exe
  .\vHQIxrurJ7eimn9.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
b0bf339c34f067561f1aec2448cf1619

SHA1
f619f8f5f71f47ca4a94de98b39c6848e1e05c54

SHA256
9ffe4fa05ff65fc9a970e7297bd945521b5d1579453c9876b71fdd6c53d73f3c

SHA512
edbae2b2787dcfa8ec368e5b5fedecbcf62310dbdef02c2c2bf45069f4d707ddbe21866e609884393d72424003d3033bafd97f8b3c8704cf35e7146187b7d3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
a7c947d25c110b6373cbd5fe1ff1698f

SHA1
19084643bb31c1bab3caf2d58d2e53164d209256

SHA256
2bed790343d7b909d70b53e18dac7229cf550c89e50f7a893c2afcafe7e06cea

SHA512
fa1378223947b39500395173ba9028bd7e3192fd9ddd662ea2338388395412453b622bb42dc1021d7a7ac32511f521ef750cc645e2d81416eed166d5890e083b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\[email protected]\install.rdf

Filesize
593B

MD5
2bb1e59820710ceaff2d3895b2682bdd

SHA1
0c5dc15bed0e177448f1bd08b75984178a355118

SHA256
5aa94ba25822cde2c9b852c1aec38d33c77f3a630bdc102eadad51b772498481

SHA512
4f4528472a4b4ab94723df3ec33063a4666cf73e35338249fc9f26a240855e0d99c80d3a0f4fcefc403d3d2eb5eb487e01ceae7d05ed2438cce77a1665bc9ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\ameclcndlcaadbompopmoapcjhhmfcjd\background.html

Filesize
142B

MD5
d1f764bc5d5564d9ee53e26fcce83ac1

SHA1
68cef9d16d558af5e3905f40f48dd4b877152317

SHA256
9b6013cff9c2a5c2426017d2bb36f333342c82a5066412a46d3c31297cbaf63f

SHA512
39b0f1112704cadb98a2f52143bbc937caae4c98e24628e775d5905df1e923a2f6d64fd19d57d72322dd053d93bdf2894929fb1568c3093d492ed767eddc32fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\ameclcndlcaadbompopmoapcjhhmfcjd\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\ameclcndlcaadbompopmoapcjhhmfcjd\jQYOQ.js

Filesize
6KB

MD5
9cc4e4c0c8c22c0a57dd5e54bdb968a9

SHA1
b527dc70fcc30b485001ae711d7809a6017d15bc

SHA256
345545653111d5eff4c1bf490522cf90a91772029f9290a3365b91e7d8ade388

SHA512
2cfdb8f09e216293544331c425248e3634bfc42cb43cf22c91f8a40eefb3264bc9cb10301acd8a031106d1741cb4ba9b0b769dc7585cae57d47ccfc9836056bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\ameclcndlcaadbompopmoapcjhhmfcjd\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\ameclcndlcaadbompopmoapcjhhmfcjd\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\vHQIxrurJ7eimn9.dat

Filesize
1KB

MD5
a33c60be34e0240975594072e5033a34

SHA1
16a6f51e8c6f3eb4ddd86a55b938449f77e214c4

SHA256
69da2a07f404c5a2a65ce9905f289ea6ee4e66ebe9a9babb353a7d7bb9575027

SHA512
508d75e0f3c95a9c8f10621950506d21608aa5db3f8f569bfda113992b19a34d86fec22002a83c083f786f8dee45cf923568d2dff4fb14d738c1c479d4725fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\vHQIxrurJ7eimn9.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F16.tmp\vHQIxrurJ7eimn9.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/4740-132-0x0000000000000000-mapping.dmp

Download