c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef

General

Target

c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe
Size

2.5MB
MD5

d3a3dba845842a99dd59d74c779e4f91
SHA1

c9ba17a637bf135302a7edf235e659d86278ea56
SHA256

c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef
SHA512

824545ffa186f4b3411a2d7ff517dfc582734c0f5b1b78ca05d0024ef688d07db5ecbc365f276d5b85e1aa558b8084806def22576b647663f0c2cc1113682c06
SSDEEP

49152:h1Os1AQ+1ho2H8swSCCwwFB9nfFVDRBTY/3X5wRLCr56JK8xa:h1OvQzVCwJ/3CRLCrY83

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Zrd8JlIcysRi1Ea.exe

pid process

1980 Zrd8JlIcysRi1Ea.exe
Loads dropped DLL 1 IoCs

Processes:

c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe

pid process

1676 c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1980	Zrd8JlIcysRi1Ea.exe

pid	process
1676	c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe

Drops Chrome extension 3 IoCs

Processes:

Zrd8JlIcysRi1Ea.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cebjhlblkhdckpjfmblaofanbnbgempd\1.0\manifest.json	Zrd8JlIcysRi1Ea.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cebjhlblkhdckpjfmblaofanbnbgempd\1.0\manifest.json	Zrd8JlIcysRi1Ea.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cebjhlblkhdckpjfmblaofanbnbgempd\1.0\manifest.json	Zrd8JlIcysRi1Ea.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Zrd8JlIcysRi1Ea.exe

pid process

1980 Zrd8JlIcysRi1Ea.exe

pid	process
1980	Zrd8JlIcysRi1Ea.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe

description	pid	process	target process
PID 1676 wrote to memory of 1980	1676	c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe	Zrd8JlIcysRi1Ea.exe
PID 1676 wrote to memory of 1980	1676	c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe	Zrd8JlIcysRi1Ea.exe
PID 1676 wrote to memory of 1980	1676	c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe	Zrd8JlIcysRi1Ea.exe
PID 1676 wrote to memory of 1980	1676	c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe	Zrd8JlIcysRi1Ea.exe

C:\Users\Admin\AppData\Local\Temp\c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe
"C:\Users\Admin\AppData\Local\Temp\c6ae37fc2cd314ac194c644bff6a0da64147fa32223051dc8063fcdc35ffadef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\Zrd8JlIcysRi1Ea.exe
.\Zrd8JlIcysRi1Ea.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
PID:1980

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\Zrd8JlIcysRi1Ea.dat
Filesize
6KB

MD5
f21d59f625f8cbe639b9990f92939402

SHA1
1f4c44ae55ac7e3a5992c4b06aa02ee132803e06

SHA256
cd44f5a4d7cee9ee564774cbb642bb76537834ede7cf2d690b8c28b4c467b500

SHA512
9c6f603b8cb9eb5039fe8fd129d552516a0649833701e6814085eaee7e8a303f01b871bda4dcd85e2b233ac5e8df32ecdd49fddd3ff4bb3ee7eb5c19b81a176e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\Zrd8JlIcysRi1Ea.exe
Filesize
778KB

MD5
2b3591a7eecb2bfda4a75c5f22f52bbb

SHA1
4b57dc7c82dfb5aee529091314787978b6f2e58d

SHA256
def761f4af36128afc624d20df658e2ac6180c3cb72d77c219c95395d57e1aff

SHA512
0bb7cdfb987b6fbeed51cd186292d119f34fb785a31c2ebe58615f7d71e350aa4b55b458cfc9433db7957b5ade46053e3fcfa7ec004b8b6e52e02857d05d6ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\cebjhlblkhdckpjfmblaofanbnbgempd\background.html
Filesize
140B

MD5
1e8b24786034977b5580efda3f31e5db

SHA1
d9dbcbd3adab77fa3f0cf4504a42bf9cea773461

SHA256
73bf054649278345d4c427e6e872365a7a8c7bf8bcb8c1e2ce2b439cb35f7a52

SHA512
aaa2d8e6d0d7986fbf89e292c403fa056943086b67adc54a3ca8d72d573a9e38d52f82aab26dd3e1188db0fd4de8f62028aba6ae6874761d2df52e2bd5bc4b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\cebjhlblkhdckpjfmblaofanbnbgempd\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\cebjhlblkhdckpjfmblaofanbnbgempd\hcH.js
Filesize
5KB

MD5
ad5515aec9fa22f071d394a468f4aefb

SHA1
c4e71486485409929171826efda1fc3491894151

SHA256
3dc999dc3b10ee98fb5e13101d784a6774780fbf5f939d9333ad4fb2359ed075

SHA512
9c3089ed2c8667342f059dd9344fccbc58d93666838208cbf97a93c0db6c1392a1cfea6b7c669bea35c7a0bd454caebbe02a54ce0144ced448ede97b3b715fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\cebjhlblkhdckpjfmblaofanbnbgempd\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\cebjhlblkhdckpjfmblaofanbnbgempd\manifest.json
Filesize
507B

MD5
d429395a45a9aa09e4ee9054e9196b30

SHA1
c5dbab4e27650b07d4d159c305d08a9d578c3a3e

SHA256
674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344

SHA512
4a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS59F3.tmp\Zrd8JlIcysRi1Ea.exe
Filesize
778KB

MD5
2b3591a7eecb2bfda4a75c5f22f52bbb

SHA1
4b57dc7c82dfb5aee529091314787978b6f2e58d

SHA256
def761f4af36128afc624d20df658e2ac6180c3cb72d77c219c95395d57e1aff

SHA512
0bb7cdfb987b6fbeed51cd186292d119f34fb785a31c2ebe58615f7d71e350aa4b55b458cfc9433db7957b5ade46053e3fcfa7ec004b8b6e52e02857d05d6ac9

Download Submit
memory/1676-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing