c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361

Analysis

max time kernel
197s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe
Size

932KB
MD5

defccbedc7ed0814f23abcaec52c2efa
SHA1

fc996df500993dc1e5142b406ffec2e83b3c3708
SHA256

c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361
SHA512

aa5d4e6a55e0b12c0fd24735200e01ebb6edac6c6d47273faa3fbcf70de168e762eaac6ff513dd2ee414bc21aac4a331f919c11bf600f002398295f335807c95
SSDEEP

24576:h1OYdaOpCZ/iWCvu/2sWsJA/jlt+DHhsg:h1Os/CpYO/dJJDHhsg

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

2gKiGeixqpYNS9G.exe

pid process

4632 2gKiGeixqpYNS9G.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

2gKiGeixqpYNS9G.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbgbnedgpmpoonnenilchbjjnfjgnlfi\2.0\manifest.json	2gKiGeixqpYNS9G.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbgbnedgpmpoonnenilchbjjnfjgnlfi\2.0\manifest.json	2gKiGeixqpYNS9G.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbgbnedgpmpoonnenilchbjjnfjgnlfi\2.0\manifest.json	2gKiGeixqpYNS9G.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbgbnedgpmpoonnenilchbjjnfjgnlfi\2.0\manifest.json	2gKiGeixqpYNS9G.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbgbnedgpmpoonnenilchbjjnfjgnlfi\2.0\manifest.json	2gKiGeixqpYNS9G.exe

Drops file in System32 directory 4 IoCs

Processes:

2gKiGeixqpYNS9G.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	2gKiGeixqpYNS9G.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	2gKiGeixqpYNS9G.exe
File opened for modification	C:\Windows\System32\GroupPolicy	2gKiGeixqpYNS9G.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	2gKiGeixqpYNS9G.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

2gKiGeixqpYNS9G.exe

pid	process
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe
4632	2gKiGeixqpYNS9G.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

2gKiGeixqpYNS9G.exe

description	pid	process
Token: SeDebugPrivilege	4632	2gKiGeixqpYNS9G.exe
Token: SeDebugPrivilege	4632	2gKiGeixqpYNS9G.exe
Token: SeDebugPrivilege	4632	2gKiGeixqpYNS9G.exe
Token: SeDebugPrivilege	4632	2gKiGeixqpYNS9G.exe
Token: SeDebugPrivilege	4632	2gKiGeixqpYNS9G.exe
Token: SeDebugPrivilege	4632	2gKiGeixqpYNS9G.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe

description	pid	process	target process
PID 3136 wrote to memory of 4632	3136	c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe	2gKiGeixqpYNS9G.exe
PID 3136 wrote to memory of 4632	3136	c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe	2gKiGeixqpYNS9G.exe
PID 3136 wrote to memory of 4632	3136	c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe	2gKiGeixqpYNS9G.exe

C:\Users\Admin\AppData\Local\Temp\c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe
"C:\Users\Admin\AppData\Local\Temp\c58b64087ddf37c20017de937e18a8c229bd540cf596131cb11ef17d641a1361.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\2gKiGeixqpYNS9G.exe
.\2gKiGeixqpYNS9G.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\2gKiGeixqpYNS9G.dat
Filesize
1KB

MD5
4d0acbb3f436ed18e0c851dde04e4c0d

SHA1
c447799ffec74990dc362f75644299ee8e83b64c

SHA256
85d9479f6e4679117471166fbec054bbb0db56eb7cc61f223ff68ff5f2ab205b

SHA512
d4e5f5561f1efddeded5fb3d0a05d8a991af35d89a441e570d3174de53cd49db1d14d0e885049354050d7720841d6ff2638e4399e6c9d0f130edd8a96f4d3ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\2gKiGeixqpYNS9G.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\2gKiGeixqpYNS9G.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
a40050a22c590f8732f7dffff32b086e

SHA1
09d798e78d47325b2e613f0914f36606e696e9f8

SHA256
df1b83b8094b0ed82af224f262cf4bc0803b145bff864773daf52446617900c1

SHA512
83753d2c5d67fc9c3f217664f2f66c419969ca888b3ebe78ce516f8128546a1959f8d12b03eb1f8bf76c5108f8a8589117505d3385886dbe6776ce2d66260798

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
a60af4d10c1efec4e606bba2b6286caf

SHA1
6279fbddad995eebdec1edc64fc4dce75d85eb27

SHA256
ddb58dc7f3a6560183a0243c9241b5b0a1a6b0de9949c245f36206a09591c981

SHA512
f73ebc4e783644ae35b82d556e9b266b4a746a8f3c7056f5495c93273d5decb9733d74b0d5c01ecb740982a23469d44927d23e514079073feb58e1a7fe86dadc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\[email protected]\install.rdf
Filesize
595B

MD5
5f574938c42588058c3ad9d182611bc6

SHA1
fbffc65398995acf0c733abf9572065d53fcc631

SHA256
3abba933c05c043d0617a378ed7a14457e0541e75b59cd445ab374f90207d2eb

SHA512
28dac241774a519217b543e186c285b2fdb8db9f91852d770604efc52cd820152329536f206c6ca2f12479c77f224713c738841eac8287b7b5164ad340b28043

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\bbgbnedgpmpoonnenilchbjjnfjgnlfi\background.html
Filesize
147B

MD5
28747f8ad9141b4ad30b15333d979b41

SHA1
a4d8a429e450eac221de05d70056663156f0b435

SHA256
e065b687e9243e58a2d2cd5ec59f9dbdeb3466276e7fe2be8793a0b4b59ca676

SHA512
7b61bae52ed3762e63759d99bad301ce64971f2000ada9abb057894bf6933dee78d56d957e559b3bc57f76bffdce3712a1778480f9c057b1637c1ee2e362d04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\bbgbnedgpmpoonnenilchbjjnfjgnlfi\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\bbgbnedgpmpoonnenilchbjjnfjgnlfi\e7w2DAdKo6.js
Filesize
6KB

MD5
20c5720e22ba121802e4ca4349419acd

SHA1
031430c80611ea694664f78636a7f74cefeeeeac

SHA256
1d1d2e4cc96939dc574e354b122999ff7d4024d786d0aabb4bac512ec8375be8

SHA512
4d98b59e07c14c90396e8a66f3f64139f9048d5bc0f17ee27b263db011f389715107cebe9549febed2e11a1296f651d4cb03c2b74ba1415f28431971093dd8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\bbgbnedgpmpoonnenilchbjjnfjgnlfi\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6040.tmp\bbgbnedgpmpoonnenilchbjjnfjgnlfi\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4632-132-0x0000000000000000-mapping.dmp

Download