Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe
Resource
win7-20221111-en
General
-
Target
c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe
-
Size
2.5MB
-
MD5
ba4fbc611556a014d907a12d443d4ca4
-
SHA1
51ac7871f5fa209f8ca61ba956c1c350be8c8706
-
SHA256
c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920
-
SHA512
f2a4310c8b463e46b7ba79bc88cfc0ec841b1153499e8519a7880d89917beb45accbedc246bf691607bb64bbc1a4307fc398240a2481ab95e2fe5556e932fdb8
-
SSDEEP
49152:h1OsQSQeb71DLvFzAqRmyyVchO4apKHcHhXa3FXWlPC1IS5zqH:h1O/SQY1DCqkck4apyLqZH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
eZB2NxFkXjnVQ1u.exepid process 4700 eZB2NxFkXjnVQ1u.exe -
Loads dropped DLL 3 IoCs
Processes:
eZB2NxFkXjnVQ1u.exeregsvr32.exeregsvr32.exepid process 4700 eZB2NxFkXjnVQ1u.exe 1924 regsvr32.exe 4120 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
eZB2NxFkXjnVQ1u.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\emnjcpbbaepikjhgmfoamclaneeinfom\2.0\manifest.json eZB2NxFkXjnVQ1u.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\emnjcpbbaepikjhgmfoamclaneeinfom\2.0\manifest.json eZB2NxFkXjnVQ1u.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\emnjcpbbaepikjhgmfoamclaneeinfom\2.0\manifest.json eZB2NxFkXjnVQ1u.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\emnjcpbbaepikjhgmfoamclaneeinfom\2.0\manifest.json eZB2NxFkXjnVQ1u.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\emnjcpbbaepikjhgmfoamclaneeinfom\2.0\manifest.json eZB2NxFkXjnVQ1u.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeeZB2NxFkXjnVQ1u.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects eZB2NxFkXjnVQ1u.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ eZB2NxFkXjnVQ1u.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} eZB2NxFkXjnVQ1u.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} eZB2NxFkXjnVQ1u.exe -
Drops file in Program Files directory 8 IoCs
Processes:
eZB2NxFkXjnVQ1u.exedescription ioc process File created C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.tlb eZB2NxFkXjnVQ1u.exe File opened for modification C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.tlb eZB2NxFkXjnVQ1u.exe File created C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.dat eZB2NxFkXjnVQ1u.exe File opened for modification C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.dat eZB2NxFkXjnVQ1u.exe File created C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dll eZB2NxFkXjnVQ1u.exe File opened for modification C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dll eZB2NxFkXjnVQ1u.exe File created C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.dll eZB2NxFkXjnVQ1u.exe File opened for modification C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.dll eZB2NxFkXjnVQ1u.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
eZB2NxFkXjnVQ1u.exepid process 4700 eZB2NxFkXjnVQ1u.exe 4700 eZB2NxFkXjnVQ1u.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exeeZB2NxFkXjnVQ1u.exeregsvr32.exedescription pid process target process PID 4172 wrote to memory of 4700 4172 c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe eZB2NxFkXjnVQ1u.exe PID 4172 wrote to memory of 4700 4172 c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe eZB2NxFkXjnVQ1u.exe PID 4172 wrote to memory of 4700 4172 c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe eZB2NxFkXjnVQ1u.exe PID 4700 wrote to memory of 1924 4700 eZB2NxFkXjnVQ1u.exe regsvr32.exe PID 4700 wrote to memory of 1924 4700 eZB2NxFkXjnVQ1u.exe regsvr32.exe PID 4700 wrote to memory of 1924 4700 eZB2NxFkXjnVQ1u.exe regsvr32.exe PID 1924 wrote to memory of 4120 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 4120 1924 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe"C:\Users\Admin\AppData\Local\Temp\c667f61c7bb2dcbeffa835d44ebd8ef6ab5c5778a1e8f9a866e323f23e138920.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\eZB2NxFkXjnVQ1u.exe.\eZB2NxFkXjnVQ1u.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.datFilesize
6KB
MD507f29c1948af81cfe219ab102ced2135
SHA1b40ba7a3ae1e026250041edfca3edbcc87e97c37
SHA256d8742bb54aa1b63a1cf3ac698cafb589106f8c3d0594c1154a34566c8fff55f4
SHA51232e546bf0dd3db5d0e1fad13b87a2bffa06c914ea3ea6ec6e3689191e099d633b9bd8f7e0a903c7b0f8fd902c46e9bbaddca22ddae89b63cb8ea55ff135d893a
-
C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.dllFilesize
745KB
MD5ce27e078a917088b7459c44570637b9d
SHA14d9e95fc9b97a1f21221f96ea8fbee55132e82b7
SHA2568804ae047c9ba998964a359f278f54fa1d671ed245b7dfe117625f1ce0d5e84f
SHA512492fdacef00a45dfe6d9db9c80b908bd0d9ebb4bf75c1f4053a8e281cfad5279646754a711484709de6f571487276ec19f71552522dc218fba8331bf6358f9ce
-
C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dllFilesize
886KB
MD51433d7e71196529644716ffc72c261b2
SHA1f35147e7dc56f4e92856061b48c9f7a872e10385
SHA2562ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f
SHA512c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c
-
C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dllFilesize
886KB
MD51433d7e71196529644716ffc72c261b2
SHA1f35147e7dc56f4e92856061b48c9f7a872e10385
SHA2562ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f
SHA512c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c
-
C:\Program Files (x86)\GoSave\9LNrQSigUIgc10.x64.dllFilesize
886KB
MD51433d7e71196529644716ffc72c261b2
SHA1f35147e7dc56f4e92856061b48c9f7a872e10385
SHA2562ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f
SHA512c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\9LNrQSigUIgc10.dllFilesize
745KB
MD5ce27e078a917088b7459c44570637b9d
SHA14d9e95fc9b97a1f21221f96ea8fbee55132e82b7
SHA2568804ae047c9ba998964a359f278f54fa1d671ed245b7dfe117625f1ce0d5e84f
SHA512492fdacef00a45dfe6d9db9c80b908bd0d9ebb4bf75c1f4053a8e281cfad5279646754a711484709de6f571487276ec19f71552522dc218fba8331bf6358f9ce
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\9LNrQSigUIgc10.tlbFilesize
3KB
MD5f636475c74627ddf7b3b6b6dfaa8d491
SHA1fb3a63977f8b0e07f18d313ace3e1f1223dc423b
SHA256e6e330d72d59551c9ba78464c4081280510901a82f66d94c84cc94ca4594e4b2
SHA512ba788afd76700c60fa8d899ea6ebc1c69594b09d9099c7cb4d408e290575c9ed89b0288df1a1ca9f1562564eb65f51f8add17f4c57eea7fe890b38592560fb96
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\9LNrQSigUIgc10.x64.dllFilesize
886KB
MD51433d7e71196529644716ffc72c261b2
SHA1f35147e7dc56f4e92856061b48c9f7a872e10385
SHA2562ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f
SHA512c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\Vg@9S.edu\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\Vg@9S.edu\chrome.manifestFilesize
35B
MD5d5474fa2edee82ef1b0eedc888776bec
SHA18d840d8b94340062b5a726d3538c3a87a5d67ca8
SHA256e47821a45f23e4abe608500db16674404c10a6d651be94693b815aa7bc6ebd99
SHA51292e2a0962fe31b35bef4ac68627d606c609c0650ecf97e5f173d341ad013f0601f16bad7e35ec4b426383089631650b17ec461687c8ed4ff076591fac3b6a9c8
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\Vg@9S.edu\content\bg.jsFilesize
7KB
MD51de0e5d1258f0b71566d84b600087d41
SHA15865562cf829b7b70e384740ef027e8c57310220
SHA256b1561913448c31a1f38abf9b46b87d30b358a32f05ad6973d5962d8c9fc2a0bf
SHA512283c58a0e2973a4709de28e8157992687e5c0858bb75d1330de1d214e00fe512230d116300506b0863b67a04a33932b667f38e02018bf0338bf5c428614c975b
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\Vg@9S.edu\install.rdfFilesize
591B
MD53592dba02a54921bfb728eebb68d13cd
SHA121abf9433c4e67a4ae215f8bf8d44bfbeb2be18e
SHA2568beec91bc021210a8b9d851e0e0a3d84d305b175ee6b838a8ed3ab8c108c3f83
SHA512cab70b0be7c93509c01ef5603c8fca3de5187c3073c203cc4ba8abf215092a64446f1c0cf92cec61ba565494d43915873ae0177413124152d76ee37e3165871d
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\eZB2NxFkXjnVQ1u.datFilesize
6KB
MD507f29c1948af81cfe219ab102ced2135
SHA1b40ba7a3ae1e026250041edfca3edbcc87e97c37
SHA256d8742bb54aa1b63a1cf3ac698cafb589106f8c3d0594c1154a34566c8fff55f4
SHA51232e546bf0dd3db5d0e1fad13b87a2bffa06c914ea3ea6ec6e3689191e099d633b9bd8f7e0a903c7b0f8fd902c46e9bbaddca22ddae89b63cb8ea55ff135d893a
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\eZB2NxFkXjnVQ1u.exeFilesize
770KB
MD5b4c30381dd37fea1c1c69bcb3ad48b32
SHA1869eca61396754586f7e85ebf65a334e01856740
SHA25666481ba6d9cbf3c7662fc7cfd867739077256f60f4165f76dfdcd9461500ae50
SHA5121e7bbdd7a75b748ff9a5f70b46766b0108effc84e0cc7c5d8a1f32e56136181060a4363ed2cbd6ed14d195a2379cf8148680380256f31b809bb77d1fe0bf064f
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\eZB2NxFkXjnVQ1u.exeFilesize
770KB
MD5b4c30381dd37fea1c1c69bcb3ad48b32
SHA1869eca61396754586f7e85ebf65a334e01856740
SHA25666481ba6d9cbf3c7662fc7cfd867739077256f60f4165f76dfdcd9461500ae50
SHA5121e7bbdd7a75b748ff9a5f70b46766b0108effc84e0cc7c5d8a1f32e56136181060a4363ed2cbd6ed14d195a2379cf8148680380256f31b809bb77d1fe0bf064f
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\emnjcpbbaepikjhgmfoamclaneeinfom\background.htmlFilesize
144B
MD54fa6033f1a8a3d1fc211793e53f4c2bb
SHA1cb2e2a54c718ac6112e5499e557c51ddd5d4fa01
SHA256d342660e95bb41b2acc9446c516ec957c8b37fb60e796fcd20fa2680fcae4af1
SHA512a85a7291186b627a3ff8578146ea90981fac76b8c9cace754c09fb939f9dd7afb8a9366d23958c9ba204dfeeb1116a79d79d26fe38306a1908f32a81068f5ef9
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\emnjcpbbaepikjhgmfoamclaneeinfom\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\emnjcpbbaepikjhgmfoamclaneeinfom\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\emnjcpbbaepikjhgmfoamclaneeinfom\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS62F5.tmp\emnjcpbbaepikjhgmfoamclaneeinfom\oFWBWeV.jsFilesize
5KB
MD54fea2d756ac72f17b0b6292549c7595d
SHA1f47c5efc1177356041dfd746fd60feb31fff00fa
SHA256ffd2e71fb36ab3bf7930bbad32397a828eee56ce329ea8a233e1d0f149dc7551
SHA5126ff7de54649864a3bd576e3bb0f79f97a68ccad4b57a6cca1af09472bc176145cf004c6e89aa2c8a0b6aa4a548884cf7119aa05342f67a944c069c7df2eac870
-
memory/1924-149-0x0000000000000000-mapping.dmp
-
memory/4120-152-0x0000000000000000-mapping.dmp
-
memory/4700-132-0x0000000000000000-mapping.dmp