Analysis
-
max time kernel
184s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe
Resource
win7-20221111-en
General
-
Target
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe
-
Size
931KB
-
MD5
4d17bc433dc85961145c864c0f0e3ad9
-
SHA1
c06c561a78f7f508e69a214880cbb699ff5f112f
-
SHA256
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d
-
SHA512
ff956d64a3c458664920e875a4ab4436bd0566055173953f29f11a15973df565a6fb396494a5a208a3a0a8e7f945f63fa01d9508dde8684333ba6d3ebf0ab00f
-
SSDEEP
24576:h1OYdaOjCZ/iWCvu/2sWsJA/jlt+DHhsQ:h1OsBCpYO/dJJDHhsQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
BTRcPLYqkqWXSqW.exepid process 2560 BTRcPLYqkqWXSqW.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
BTRcPLYqkqWXSqW.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\neohijedlipmccbahknbjfnogokomkhd\2.0\manifest.json BTRcPLYqkqWXSqW.exe -
Drops file in System32 directory 4 IoCs
Processes:
BTRcPLYqkqWXSqW.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy BTRcPLYqkqWXSqW.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini BTRcPLYqkqWXSqW.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol BTRcPLYqkqWXSqW.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI BTRcPLYqkqWXSqW.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
BTRcPLYqkqWXSqW.exepid process 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe 2560 BTRcPLYqkqWXSqW.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
BTRcPLYqkqWXSqW.exedescription pid process Token: SeDebugPrivilege 2560 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 2560 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 2560 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 2560 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 2560 BTRcPLYqkqWXSqW.exe Token: SeDebugPrivilege 2560 BTRcPLYqkqWXSqW.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exedescription pid process target process PID 2968 wrote to memory of 2560 2968 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe PID 2968 wrote to memory of 2560 2968 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe PID 2968 wrote to memory of 2560 2968 c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe BTRcPLYqkqWXSqW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe"C:\Users\Admin\AppData\Local\Temp\c67ee42ef436fe40e61f64919f5b7863984e579948139f683b6ac13271f78e1d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\BTRcPLYqkqWXSqW.exe.\BTRcPLYqkqWXSqW.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\BTRcPLYqkqWXSqW.datFilesize
1KB
MD5b081947e248109d1097e8721df68c0d0
SHA1668ae2342b9a376932612d94fea7425fa527c9e6
SHA256a1f47ae7155c1c0e3f644c6ce434fca742b60ef0c4e682f8ce78d4b547a6f17e
SHA5126d8304582c42def41649f282ba844fde93414207085822577d7c00c8deac9f881ed280814c7bb090193066f2e8ac8be5f9eeaee7eaaa42cc0a3ce687a9c7d5ee
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\BTRcPLYqkqWXSqW.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\BTRcPLYqkqWXSqW.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\j@u.co.uk\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\j@u.co.uk\chrome.manifestFilesize
35B
MD50799ecbcc36dfe12c8e25065ac50f70c
SHA1d5afa8ea84309295c2d559dfb1e8e775abca5886
SHA2569a3257feb7449413ce027cb3f41298291e7c84109208025c6a666f1abea8af2f
SHA51227384a4b45fc1f27b3827c3adde4dea11b04f1a12627232b5a3d633b102020a8305fe0a538adc37f11f9cfed1c825bc7c9744183ab25d7b7f4e22d4de7499b35
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\j@u.co.uk\content\bg.jsFilesize
8KB
MD565b9b2617f669809b35ba4d28414fba7
SHA1221e9c8b787e7612eb8ec8398752f4925941e139
SHA25606facd03b45ff076e111803ccca3fe6c6bbb8e4d87b9ce22fcc67459a3077bb6
SHA512cdb658be2eacb1aa6a6feba0171fa3f38e50a2d7edefd4d821e7bdfd7601cc97be2697e2d04680b4091e91760a132b84a75925ace7390488b3fd416af077a1d4
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\j@u.co.uk\install.rdfFilesize
592B
MD5559af8356fb36237efb7b3d2bc66663b
SHA1f8b3d2342312ad936d19a8108da139eeb0c2715b
SHA2563e862b0374f0bacf8db75274fa07aa8435245caccd160b5f7e9dd79f99e4527f
SHA5122c39d4caca7271759cda486d3f2236e060d52155ecc8a9c2adf9eaa70d1ca475c83605c4174325d3d32e0ba1b50cb350fc38ded688a669726076b9cb7b428af8
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\neohijedlipmccbahknbjfnogokomkhd\JQ88V.jsFilesize
6KB
MD5094eba362f3bbf296ffd50bb99598ab9
SHA1f3c545078ffcd3642e604af6c635b8112cbc19b9
SHA256693b643d1506ab07c748d52e3da70eebe5664b079dbf0e68e3dba90a16d59d61
SHA512fbbeca547b33e06119d411b86ce3b907fa4c1db247d29e9bcfa975d33ab97aa91dbee11b2d3c87444d8088721155188e344760bbaab6965dfada5038db928b38
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\neohijedlipmccbahknbjfnogokomkhd\background.htmlFilesize
142B
MD55a2e3d6e35003bea2399bd92edeff422
SHA14e9c30cd4ec4d025d93a8a2da3683bdd9d798f42
SHA25634940f3dac73c4380d2ae60e0dde7058ba02c52530179d11c71925c48bbceff5
SHA512f4b3888a29d7495b8b8e3b5d0db880e48a255608eadd3b822f22b33ad5a9c343f28ba2a2257fac791ca65316997275831aed39d2264c1c00a1404ae2c7adf6ec
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\neohijedlipmccbahknbjfnogokomkhd\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\neohijedlipmccbahknbjfnogokomkhd\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSD8D.tmp\neohijedlipmccbahknbjfnogokomkhd\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/2560-132-0x0000000000000000-mapping.dmp