Analysis
-
max time kernel
41s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe
Resource
win7-20221111-en
General
-
Target
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe
-
Size
931KB
-
MD5
4d17bc433dc85961145c864c0f0e3ad9
-
SHA1
c06c561a78f7f508e69a214880cbb699ff5f112f
-
SHA256
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d
-
SHA512
ff956d64a3c458664920e875a4ab4436bd0566055173953f29f11a15973df565a6fb396494a5a208a3a0a8e7f945f63fa01d9508dde8684333ba6d3ebf0ab00f
-
SSDEEP
24576:h1OYdaOjCZ/iWCvu/2sWsJA/jlt+DHhsQ:h1OsBCpYO/dJJDHhsQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
BTRcPLYqkqWXSqW.exepid process 1208 BTRcPLYqkqWXSqW.exe -
Loads dropped DLL 1 IoCs
Processes:
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exepid process 1352 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
BTRcPLYqkqWXSqW.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe -
Drops file in System32 directory 4 IoCs
Processes:
BTRcPLYqkqWXSqW.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy BTRcPLYqkqWXSqW.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini BTRcPLYqkqWXSqW.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol BTRcPLYqkqWXSqW.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI BTRcPLYqkqWXSqW.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
BTRcPLYqkqWXSqW.exepid process 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe 1208 BTRcPLYqkqWXSqW.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
BTRcPLYqkqWXSqW.exedescription pid process Token: SeDebugPrivilege 1208 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 1208 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 1208 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 1208 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 1208 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 1208 BTRcPLYqkqWXSqW.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exedescription pid process target process PID 1352 wrote to memory of 1208 1352 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe PID 1352 wrote to memory of 1208 1352 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe PID 1352 wrote to memory of 1208 1352 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe PID 1352 wrote to memory of 1208 1352 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe"C:\Users\Admin\AppData\Local\Temp\c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\BTRcPLYqkqWXSqW.exe.\BTRcPLYqkqWXSqW.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\BTRcPLYqkqWXSqW.datFilesize
1KB
MD5b081947e248109d1097e8721df68c0d0
SHA1668ae2342b9a376932612d94fea7425fa527c9e6
SHA256a1f47ae7155c1c0e3f644c6ce434fca742b60ef0c4e682f8ce78d4b547a6f17e
SHA5126d8304582c42def41649f282ba844fde93414207085822577d7c00c8deac9f881ed280814c7bb090193066f2e8ac8be5f9eeaee7eaaa42cc0a3ce687a9c7d5ee
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\BTRcPLYqkqWXSqW.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\j@u.co.uk\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\j@u.co.uk\chrome.manifestFilesize
35B
MD50799ecbcc36dfe12c8e25065ac50f70c
SHA1d5afa8ea84309295c2d559dfb1e8e775abca5886
SHA2569a3257feb7449413ce027cb3f41298291e7c84109208025c6a666f1abea8af2f
SHA51227384a4b45fc1f27b3827c3adde4dea11b04f1a12627232b5a3d633b102020a8305fe0a538adc37f11f9cfed1c825bc7c9744183ab25d7b7f4e22d4de7499b35
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\j@u.co.uk\content\bg.jsFilesize
8KB
MD565b9b2617f669809b35ba4d28414fba7
SHA1221e9c8b787e7612eb8ec8398752f4925941e139
SHA25606facd03b45ff076e111803ccca3fe6c6bbb8e4d87b9ce22fcc67459a3077bb6
SHA512cdb658be2eacb1aa6a6feba0171fa3f38e50a2d7edefd4d821e7bdfd7601cc97be2697e2d04680b4091e91760a132b84a75925ace7390488b3fd416af077a1d4
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\j@u.co.uk\install.rdfFilesize
592B
MD5559af8356fb36237efb7b3d2bc66663b
SHA1f8b3d2342312ad936d19a8108da139eeb0c2715b
SHA2563e862b0374f0bacf8db75274fa07aa8435245caccd160b5f7e9dd79f99e4527f
SHA5122c39d4caca7271759cda486d3f2236e060d52155ecc8a9c2adf9eaa70d1ca475c83605c4174325d3d32e0ba1b50cb350fc38ded688a669726076b9cb7b428af8
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\neohijedlipmccbahknbjfnogokomkhd\JQ88V.jsFilesize
6KB
MD5094eba362f3bbf296ffd50bb99598ab9
SHA1f3c545078ffcd3642e604af6c635b8112cbc19b9
SHA256693b643d1506ab07c748d52e3da70eebe5664b079dbf0e68e3dba90a16d59d61
SHA512fbbeca547b33e06119d411b86ce3b907fa4c1db247d29e9bcfa975d33ab97aa91dbee11b2d3c87444d8088721155188e344760bbaab6965dfada5038db928b38
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\neohijedlipmccbahknbjfnogokomkhd\background.htmlFilesize
142B
MD55a2e3d6e35003bea2399bd92edeff422
SHA14e9c30cd4ec4d025d93a8a2da3683bdd9d798f42
SHA25634940f3dac73c4380d2ae60e0dde7058ba02c52530179d11c71925c48bbceff5
SHA512f4b3888a29d7495b8b8e3b5d0db880e48a255608eadd3b822f22b33ad5a9c343f28ba2a2257fac791ca65316997275831aed39d2264c1c00a1404ae2c7adf6ec
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\neohijedlipmccbahknbjfnogokomkhd\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\neohijedlipmccbahknbjfnogokomkhd\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\neohijedlipmccbahknbjfnogokomkhd\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zSCD9C.tmp\BTRcPLYqkqWXSqW.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1208-56-0x0000000000000000-mapping.dmp
-
memory/1352-54-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB