c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3

Analysis

max time kernel
175s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe
Size

920KB
MD5

bbca8db27168d6e98962196966e1ea4b
SHA1

4c1b69f833e541a05f13ac9f93b228c006f29e7f
SHA256

c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3
SHA512

0090fed54c7e546d54e9f129a40a6173786b5aa806175c3593894856801b39c1115c5302dfd06996ece79d30c51a8b604f0978fb80fc3181296380200e9eb3b3
SSDEEP

24576:h1OYdaObMtdHAqcdDVhYwiei7+EpFAh/kKn:h1OsuPHVmVhYwiLtKkKn

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

iROr4EQbzxLmsrp.exe

pid process

1532 iROr4EQbzxLmsrp.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

iROr4EQbzxLmsrp.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnoablahopcnppbkpmoakigiekacnghd\2.0\manifest.json	iROr4EQbzxLmsrp.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnoablahopcnppbkpmoakigiekacnghd\2.0\manifest.json	iROr4EQbzxLmsrp.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnoablahopcnppbkpmoakigiekacnghd\2.0\manifest.json	iROr4EQbzxLmsrp.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnoablahopcnppbkpmoakigiekacnghd\2.0\manifest.json	iROr4EQbzxLmsrp.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnoablahopcnppbkpmoakigiekacnghd\2.0\manifest.json	iROr4EQbzxLmsrp.exe

Drops file in System32 directory 4 IoCs

Processes:

iROr4EQbzxLmsrp.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	iROr4EQbzxLmsrp.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	iROr4EQbzxLmsrp.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	iROr4EQbzxLmsrp.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	iROr4EQbzxLmsrp.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

iROr4EQbzxLmsrp.exe

pid	process
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe
1532	iROr4EQbzxLmsrp.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

iROr4EQbzxLmsrp.exe

description	pid	process
Token: SeDebugPrivilege	1532	iROr4EQbzxLmsrp.exe
Token: SeDebugPrivilege	1532	iROr4EQbzxLmsrp.exe
Token: SeDebugPrivilege	1532	iROr4EQbzxLmsrp.exe
Token: SeDebugPrivilege	1532	iROr4EQbzxLmsrp.exe
Token: SeDebugPrivilege	1532	iROr4EQbzxLmsrp.exe
Token: SeDebugPrivilege	1532	iROr4EQbzxLmsrp.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe

description	pid	process	target process
PID 2560 wrote to memory of 1532	2560	c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe	iROr4EQbzxLmsrp.exe
PID 2560 wrote to memory of 1532	2560	c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe	iROr4EQbzxLmsrp.exe
PID 2560 wrote to memory of 1532	2560	c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe	iROr4EQbzxLmsrp.exe

C:\Users\Admin\AppData\Local\Temp\c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe
"C:\Users\Admin\AppData\Local\Temp\c5a52ad927b78f69eabe32d13e9cc6d3d1aabbdfc911c264718d9eb87f9e10d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\iROr4EQbzxLmsrp.exe
.\iROr4EQbzxLmsrp.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
9bbbdbbea53571d0422334492a5171d3

SHA1
a1dddf04d88e19ad45f86fe65910b3d9eebb307e

SHA256
b96f9a42ef54b9986b3f199f4c07458c38faa1e77c2be823216ac2901aa88e01

SHA512
54f758f949ad149965cdf782903912bc7ed8673d13277dceb3c01f5a647ab652ca4c355a1e4e359582e9179a916cc6a785bbc0b07edcb7291164dadd8690c8ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
d59c280bf7ea96fdd70fd8e3a63ff9f7

SHA1
3e93658a97e90c1431f2f1d8cb14e5be0776ccd4

SHA256
a9f5d1ec8b6d1bfac9ba86af864c2ae4c6d87cea744fd9c668e1ebd84d7217e4

SHA512
5309706a984883277b630cdea717a140c8143a4241d875cf59e3b70a7b94fdc45e7762090ee21445e53a225b0c503567c8b5935334008bc18cddb7e4e3ef82dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\[email protected]\install.rdf
Filesize
595B

MD5
b203b15adc22c1ec63b3b91fea2a80e8

SHA1
61d48612853bd1728f828fe99b9be4e032ca8661

SHA256
db220cae2ae865cfe5c7caa8ecf1459d65ca95d1c390a08510902dc8192b4226

SHA512
ffd41e56ecf3b29a3b99228c69d7a85b69befcbb522271517646c12d390fda4849a1030540df6fb852431fa7513ae73603d63d5c0f04ec943adb869e97029482

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\iROr4EQbzxLmsrp.dat
Filesize
1KB

MD5
b95a4cdb478934ea746ae6d5ab18156e

SHA1
941796b56aa500852fd06110313dd94860841c23

SHA256
7130450a80b954939198a034d70987bc454983a9283180cfd41b0005051eb531

SHA512
ef5ace8eb96b4fdc342dea896d11a561470fae7690897bed9c2b1cfa4747057349ada5b9fadade697afb5ffd447e6905b6353f0252e41749d9213c42a64dce9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\iROr4EQbzxLmsrp.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\iROr4EQbzxLmsrp.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\jnoablahopcnppbkpmoakigiekacnghd\TCM5mj.js
Filesize
6KB

MD5
282c93bf25d4743d499659605c578381

SHA1
335b510ca88b56d39b3dfab650fabb9b52108a71

SHA256
6e6900e04a5b442c7476af05f7b41e08a0334461492e2d6e68db0850fc57e13a

SHA512
c0ce6440eb874ac6e80ba2b3dbdcf900480baab887bec1f42133bdf93691a897a19703e58f9b0012af8cdd70d5697f177a80ddda87c193805d6eefa61c267fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\jnoablahopcnppbkpmoakigiekacnghd\background.html
Filesize
143B

MD5
067390a2a276b4b3d57723b347ad4be7

SHA1
e5f4203b0228c56d60c16c45ac226b34353e73d0

SHA256
84a4fcce386e1577b3492e1d855daaf0eb25091fb5c5a1b95ecc652530a9d79d

SHA512
46e4317038a0a96a15d1259abd6ebff0f139e7b19e342d3d88fb8de2dff7e5e2989836b1fa58f7792c426851f2c4c2af620e7765b88d8eb59cdbc3ccba9d7d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\jnoablahopcnppbkpmoakigiekacnghd\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\jnoablahopcnppbkpmoakigiekacnghd\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF14A.tmp\jnoablahopcnppbkpmoakigiekacnghd\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1532-132-0x0000000000000000-mapping.dmp

Download