Analysis
-
max time kernel
202s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe
Resource
win7-20220812-en
General
-
Target
c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe
-
Size
931KB
-
MD5
52104f43e1e9c8aaaf35257ffc6c5fe8
-
SHA1
56aedcb27296a595012be0238826f8588beefc86
-
SHA256
c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03
-
SHA512
817775cd8a3889fa874195e756271325f06822d44464b2226e5b93b6be9119457dd82ead683a7db5ea4023894cb3d870a8d786ada8823b623e281327f430c399
-
SSDEEP
24576:h1OYdaORCZ/iWCvu/2sWsJA/jlt+DHhs5:h1Os3CpYO/dJJDHhs5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Yzw0o10kn7kFnl7.exepid process 1152 Yzw0o10kn7kFnl7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
Yzw0o10kn7kFnl7.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbkkhobjmncngamnhoidaenbmhcedha\2.0\manifest.json Yzw0o10kn7kFnl7.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbkkhobjmncngamnhoidaenbmhcedha\2.0\manifest.json Yzw0o10kn7kFnl7.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbkkhobjmncngamnhoidaenbmhcedha\2.0\manifest.json Yzw0o10kn7kFnl7.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbkkhobjmncngamnhoidaenbmhcedha\2.0\manifest.json Yzw0o10kn7kFnl7.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbkkhobjmncngamnhoidaenbmhcedha\2.0\manifest.json Yzw0o10kn7kFnl7.exe -
Drops file in System32 directory 4 IoCs
Processes:
Yzw0o10kn7kFnl7.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy Yzw0o10kn7kFnl7.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Yzw0o10kn7kFnl7.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol Yzw0o10kn7kFnl7.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI Yzw0o10kn7kFnl7.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Yzw0o10kn7kFnl7.exepid process 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe 1152 Yzw0o10kn7kFnl7.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Yzw0o10kn7kFnl7.exedescription pid process Token: SeDebugPrivilege 1152 Yzw0o10kn7kFnl7.exe Token: SeDebugPrivilege 1152 Yzw0o10kn7kFnl7.exe Token: SeDebugPrivilege 1152 Yzw0o10kn7kFnl7.exe Token: SeDebugPrivilege 1152 Yzw0o10kn7kFnl7.exe Token: SeDebugPrivilege 1152 Yzw0o10kn7kFnl7.exe Token: SeDebugPrivilege 1152 Yzw0o10kn7kFnl7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exedescription pid process target process PID 1220 wrote to memory of 1152 1220 c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe Yzw0o10kn7kFnl7.exe PID 1220 wrote to memory of 1152 1220 c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe Yzw0o10kn7kFnl7.exe PID 1220 wrote to memory of 1152 1220 c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe Yzw0o10kn7kFnl7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe"C:\Users\Admin\AppData\Local\Temp\c65b029c65b8e4d148a7b30942b046b71c68f0b23773bf2ca9cf7a175367bf03.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\Yzw0o10kn7kFnl7.exe.\Yzw0o10kn7kFnl7.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\EScPSOjm7r@m.edu\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\EScPSOjm7r@m.edu\chrome.manifestFilesize
35B
MD52839699a0c0c6ec150ffcf3a75892703
SHA141303bdce6319f1341895b1c35ca2874c796a5c0
SHA25675341b942c639d1f87011f64fa62f86a13132e18f3ecf5cad1637e33314bf822
SHA512b5d8089f70f9cafc47dff39ceba2a7c055970d123426a1d2f1d0ee10edc4622197c9f726047e053d7f112c38e63229cddf272d5629bd3a6ac7d371dbc12da284
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\EScPSOjm7r@m.edu\content\bg.jsFilesize
8KB
MD5db971f2c99e186ddc2f196db375aa069
SHA1c2671dcd45dbc84d614c5d1a55308cce9310c002
SHA2561545e1f4930f71277f1ba52b3125bcb18b57867f5a543dfd0941c62d80558b62
SHA512dc3de8ead4a8f67485b1d1efccb8f2837bf29188548a956eafbeff664119fd486bcd63dc7a2a26cfd59757a6c9f8bc8a917fb157e22620a19149c1087788299e
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\EScPSOjm7r@m.edu\install.rdfFilesize
599B
MD5f24c8cc9942da01c7c233a1cc70b67e3
SHA1aed3190b2ae22e7588dc9d43def4345de524e298
SHA2564e42bb67d70d4eba06d5cc3e32bd30b29abefd7cc5e57149fc9aa011a2684cf4
SHA5124ac8ca27bde2c97faa46ba5822d1a5bac0696229acfb2c18f04c8cf37e84f762ff4e47fa45ad09899737fb8a61d7b34f7ef8d9c3935145023cca8e3369a8b286
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\Yzw0o10kn7kFnl7.datFilesize
1KB
MD596b0ae2ad57eb97ed571f3bc0075fc9e
SHA1ec16505bb6629ed3e6fe79f859ea50c86884039b
SHA25610a9f3f1c9f221d186bbaa5a6bd271fd4e55fa6496b94470f9742c89ff513919
SHA5128fa7a9b36928a0c89e1fe905389e2b20b0a3aa8910f51bb6466459507d9a5ab47fd725b516285e10a7a65064cb2a58886a3734f161cecec10df553bb7169e42c
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\Yzw0o10kn7kFnl7.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\Yzw0o10kn7kFnl7.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\lkbkkhobjmncngamnhoidaenbmhcedha\background.htmlFilesize
139B
MD55bfd98a17174bb204b410376a0e8532e
SHA140c53f9e786b08ea582008700afcf26de92d13c6
SHA2567662e4ccdbfbe4968af2ea111e564fe5ae2c3cdd7802d5d7d42868b195084627
SHA5120bdfae03586a85b6c4ff331b221f36265ef9d446c9f6fb7ba9d4149019cd832f187d590e7a266a2a84580e93fef82c239952945de91e3b9d5b5100011d75ffb1
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\lkbkkhobjmncngamnhoidaenbmhcedha\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\lkbkkhobjmncngamnhoidaenbmhcedha\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\lkbkkhobjmncngamnhoidaenbmhcedha\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS55A2.tmp\lkbkkhobjmncngamnhoidaenbmhcedha\xA.jsFilesize
6KB
MD58148c01c7cb0ec266bafd441c35d8b8b
SHA1f6e8d135b7381657fae3a8195be30bcdd7d1c20d
SHA256577b4310909982e579ad95bc65441d20f46c7eab10bc42f8de2c7d00adb56178
SHA512bd6718963edd582f729a17725b169c37022043436276e4b56fe373123428f2f5197c79d30ae8ce256264ef2605d8e62c68f9aa8c23c70fb944d9a9f5c8d26819
-
memory/1152-132-0x0000000000000000-mapping.dmp