Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe
Resource
win7-20220812-en
General
-
Target
c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe
-
Size
931KB
-
MD5
3989847c365407f77e171b27c2bfe7b0
-
SHA1
cd8d9f39cb03a4a642f593546b0ec53db479a63b
-
SHA256
c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6
-
SHA512
994a33cf5231483d62ebbf494d0f6ed98e2080ba3e7f7d11c427297bb77045802b6e4dbfeba0736e7ff1276769073faf1d1f39110e2503592d4164fa21bd8c6f
-
SSDEEP
24576:h1OYdaOSCZ/iWCvu/2sWsJA/jlt+DHhsZ:h1OscCpYO/dJJDHhsZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
mMtmUGAJtMmyNWO.exepid process 2516 mMtmUGAJtMmyNWO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
mMtmUGAJtMmyNWO.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eepjgibonomeaclddieapmamlhandpcj\2.0\manifest.json mMtmUGAJtMmyNWO.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eepjgibonomeaclddieapmamlhandpcj\2.0\manifest.json mMtmUGAJtMmyNWO.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eepjgibonomeaclddieapmamlhandpcj\2.0\manifest.json mMtmUGAJtMmyNWO.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eepjgibonomeaclddieapmamlhandpcj\2.0\manifest.json mMtmUGAJtMmyNWO.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eepjgibonomeaclddieapmamlhandpcj\2.0\manifest.json mMtmUGAJtMmyNWO.exe -
Drops file in System32 directory 4 IoCs
Processes:
mMtmUGAJtMmyNWO.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini mMtmUGAJtMmyNWO.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol mMtmUGAJtMmyNWO.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI mMtmUGAJtMmyNWO.exe File opened for modification C:\Windows\System32\GroupPolicy mMtmUGAJtMmyNWO.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
mMtmUGAJtMmyNWO.exepid process 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe 2516 mMtmUGAJtMmyNWO.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
mMtmUGAJtMmyNWO.exedescription pid process Token: SeDebugPrivilege 2516 mMtmUGAJtMmyNWO.exe Token: SeDebugPrivilege 2516 mMtmUGAJtMmyNWO.exe Token: SeDebugPrivilege 2516 mMtmUGAJtMmyNWO.exe Token: SeDebugPrivilege 2516 mMtmUGAJtMmyNWO.exe Token: SeDebugPrivilege 2516 mMtmUGAJtMmyNWO.exe Token: SeDebugPrivilege 2516 mMtmUGAJtMmyNWO.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exedescription pid process target process PID 3708 wrote to memory of 2516 3708 c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe mMtmUGAJtMmyNWO.exe PID 3708 wrote to memory of 2516 3708 c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe mMtmUGAJtMmyNWO.exe PID 3708 wrote to memory of 2516 3708 c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe mMtmUGAJtMmyNWO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe"C:\Users\Admin\AppData\Local\Temp\c5a6703f2031cfe01ed85e0e7eb4fc0e00616fedd47f4c2a5e105d2d35854be6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\mMtmUGAJtMmyNWO.exe.\mMtmUGAJtMmyNWO.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\[email protected]\chrome.manifestFilesize
35B
MD5360636284f0be6a680978f466de7f82b
SHA1c90af21c20a07f74bea9444c30d68a95f9fdc9df
SHA2565fbd453d6aa34f48cf363ea8607c3159c2aec07f04ce9f8ec7a79c959c86db56
SHA5128118ca6d94495b75af643d2f44169fae7eab4113d8db3e469acf3336ad4af3ce8ed888104b7dcf5f63f5758397d797fe0e90a2fb55da36455f113d313b475e04
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5b07d31899643b471a30e01869f3e7696
SHA15ef069edced5603adb6b852a1c80da604f26f43b
SHA25611e1489034caaaa125f969323acbd070e8f189c7ab394b259aa842f316bf3570
SHA512f1233842ed87576c0043cb51124642a360601c13d5f7b79590bfe79d84690a896998072e57b32f4783c7572c9fb3aa853172932be2ee3e1a146494d9ae6cce82
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\[email protected]\install.rdfFilesize
592B
MD5b77b80bde389eed1614614b37827172f
SHA1b89f9ff16409fdb3019b8a261acce585593e1bb5
SHA256b90ab9b79fae2a185d46d9832cc97ffe5e3df8b8a1ef8ed7acc988496075cdaa
SHA5125bab1c64b4f706410904b36c4203cb1ff2dffce0a6c1c727b5c835ca448ef6087fbc4d8b73c8187f4ad9649c39362a40376b4a57298056e23722fa1b6d8f5527
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\eepjgibonomeaclddieapmamlhandpcj\UCQOAC.jsFilesize
6KB
MD5e41b63d965b95d6b300e3dba2b0ee60a
SHA16b9ea5f945a3336167162983c25fb440e7388a00
SHA2567d96b4eaddd82251d4dcbdbfce28c1c6551ed70ae083ef2fd500d2181459f3d1
SHA5129eec828f4f43675cdad78c51cb9ae5b9406e5fd29c7c120dcc98ee773632558b93c9684ebc141ee52e42e514c2b689a2cb4b73cf6914cfa4b866cbdd908a2738
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\eepjgibonomeaclddieapmamlhandpcj\background.htmlFilesize
143B
MD56df9f59ca058d2b1659b0abb5565bdd6
SHA15ddbb928a9ad92c9ff9450c7f6491eaa87220631
SHA256edcdd79ae03169985d49ddde86a1c1c2128fbf57966c2b9b95c07b0d361981f6
SHA512f85a8e8c09e9757f7a533b7da896e630f34876cb03e6a7d08e89e05d47bee6c48f3fdaded0d7b704c34121c54c179bbc726c41fca5346b800a0bae465594849f
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\eepjgibonomeaclddieapmamlhandpcj\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\eepjgibonomeaclddieapmamlhandpcj\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\eepjgibonomeaclddieapmamlhandpcj\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\mMtmUGAJtMmyNWO.datFilesize
1KB
MD52753dfacd0a9f329b9e16e8fd5b50651
SHA147133624cd447bc4de93093f1ae8edc3a7fed9d2
SHA25630e9ff8026d453999fbf288f216a0a661b2dd5779f76703fa7ea9f89bc3cd8af
SHA5121b21e0cb13a70579d9ff20f43a3c37f14c77af549c64febba57b6d310c0c69a18949d3a76006e599a457c35154cd091744c1252c2b167c77754b6ef53c7d19e6
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\mMtmUGAJtMmyNWO.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSFF06.tmp\mMtmUGAJtMmyNWO.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/2516-132-0x0000000000000000-mapping.dmp