Analysis
-
max time kernel
127s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe
Resource
win7-20221111-en
General
-
Target
c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe
-
Size
931KB
-
MD5
92a4fc495209a6a909cd996c2df096ca
-
SHA1
206017685262205125081a396057d87da6129eb4
-
SHA256
c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba
-
SHA512
4184832b466e055621e36c62c491b5747488f05d17fe5a222a41b035b9ea6051a052e8fca306956c96e7bcc00d8bc47b96590893f8555b4418825bad0117c9a8
-
SSDEEP
24576:h1OYdaOaCZ/iWCvu/2sWsJA/jlt+DHhsy:h1OskCpYO/dJJDHhsy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
tXgxPrbVwuiNYVf.exepid process 4724 tXgxPrbVwuiNYVf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
tXgxPrbVwuiNYVf.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\2.0\manifest.json tXgxPrbVwuiNYVf.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\2.0\manifest.json tXgxPrbVwuiNYVf.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\2.0\manifest.json tXgxPrbVwuiNYVf.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\2.0\manifest.json tXgxPrbVwuiNYVf.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\2.0\manifest.json tXgxPrbVwuiNYVf.exe -
Drops file in System32 directory 4 IoCs
Processes:
tXgxPrbVwuiNYVf.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy tXgxPrbVwuiNYVf.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini tXgxPrbVwuiNYVf.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol tXgxPrbVwuiNYVf.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI tXgxPrbVwuiNYVf.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
tXgxPrbVwuiNYVf.exepid process 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe 4724 tXgxPrbVwuiNYVf.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
tXgxPrbVwuiNYVf.exedescription pid process Token: SeDebugPrivilege 4724 tXgxPrbVwuiNYVf.exe Token: SeDebugPrivilege 4724 tXgxPrbVwuiNYVf.exe Token: SeDebugPrivilege 4724 tXgxPrbVwuiNYVf.exe Token: SeDebugPrivilege 4724 tXgxPrbVwuiNYVf.exe Token: SeDebugPrivilege 4724 tXgxPrbVwuiNYVf.exe Token: SeDebugPrivilege 4724 tXgxPrbVwuiNYVf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exedescription pid process target process PID 2808 wrote to memory of 4724 2808 c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe tXgxPrbVwuiNYVf.exe PID 2808 wrote to memory of 4724 2808 c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe tXgxPrbVwuiNYVf.exe PID 2808 wrote to memory of 4724 2808 c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe tXgxPrbVwuiNYVf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe"C:\Users\Admin\AppData\Local\Temp\c649d2bb4d9e3c9b208d2cd435d2053432ffddec858ba87ce19b8260ea590aba.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\tXgxPrbVwuiNYVf.exe.\tXgxPrbVwuiNYVf.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\background.htmlFilesize
146B
MD5578bf453cbb87c435d18ce28bc8fb866
SHA17d2e12fa7eb20e27d7d88ddd05b162c6f0faf833
SHA2564eb63fb672676fd997d833932e3b9474ee2c0426c1ba9c8768f75016580c9519
SHA512540c7c7a1805c4d609b8970edeb4af477e1f5973443d799f114f209eb9f99b7aabafd33f4e396e1cef7d221544a7e5e5a44befd1216c1fd97217ca23eca640be
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\ikaemgpihjeaedcjjpfaphbbjgkfcfkm\oNR8U1Zlc.jsFilesize
6KB
MD5dc3a4d4f60359e8471c7781d7c8d42a6
SHA1e417b8fff6fd78d95f580a4186413f7c169311c5
SHA256ad757e3411f5d1af1dca23c1af529455e0e475b59fbb0876b59f7f91318e5d2e
SHA5120bb6ae8fae252262dc1c302213b823cd5f42676ee9a4a122e10d8723e7989f3b1eed5e3e60e5bc15588860d16a586052605b75c7a083b03a48b1af75045fd0d5
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\tXgxPrbVwuiNYVf.datFilesize
1KB
MD5c732b8aeb3c511f9604be83c42d7595a
SHA12b13f05c401a5ed0e1ff0919efb08e5c4281ee69
SHA25680ca58d8f5e9de72c10787cbe9cfdec6f3f923eb065c6186979f3cdde163f391
SHA5125088c8a3c0bd83e188d7ccb4a97a60c5eecfaef711bca1809143850470ec9ca7e5466c3a9af706767e966b59372e919c636d1057a8d16c73e31d4a59c669cc5f
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\tXgxPrbVwuiNYVf.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\tXgxPrbVwuiNYVf.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\zVxLMtZ4@kXM.edu\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\zVxLMtZ4@kXM.edu\chrome.manifestFilesize
35B
MD57ebd6cf5a86b3584714b9b407fd0fac8
SHA1e49a97078abda8ade7174da98c0366afc2d3d703
SHA2563a611d08d1d4fe0c71a34eca3d23a66f829745600c6cc7c8a179f6f79a24f166
SHA5123f51c4eb283bd2a2b879a8b24b56d271575ee8bf4710a717d9ff690b29be13c0d5abe06e81a97680d6ce4c93724f1f8f2a6cdbf05020e28caa15306d35bf6032
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\zVxLMtZ4@kXM.edu\content\bg.jsFilesize
8KB
MD5f4977fc02f118677fade64f1e85dd095
SHA13ec00c1fd9c13df684484a407b2b141dbaa485db
SHA256e647e276b33687d8c6d02aa566ad73495a0562f468408edf4feefeba56293c91
SHA5122783230616681c9d9f424fbe1ff20e2e9f58a269ded910851e3e17def24f6f2181d063b926c5d4d77c02c557d87b559971e7b89f88cf812622ec3dffb7862114
-
C:\Users\Admin\AppData\Local\Temp\7zSAD0D.tmp\zVxLMtZ4@kXM.edu\install.rdfFilesize
598B
MD570246b87474c0275ebbbbfa8f56d8fc7
SHA16ab493bf6db826cd0dac7911d3345c9f96928527
SHA256708ee338478053297aa3cfe3cc1ee90765a93c8d7ec2d7e23ef0c10fd522ec9a
SHA512d0efd7ce8219ad49cfb518522bf48f6a99fe5dac0e41f9f27c2d6da15e3a1c552f4d899ce8152333021553018e25ce10a65b3dccc454a92518b718204511f236
-
memory/4724-132-0x0000000000000000-mapping.dmp