Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe
Resource
win7-20220812-en
General
-
Target
c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe
-
Size
920KB
-
MD5
1f7646e22b71407fec632898dffc5c64
-
SHA1
e872ac758170f518e1e411c68d16608e499862cc
-
SHA256
c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598
-
SHA512
70991b10707d158f8a2271e8140ccdc53dcd4042a89ca0d420587c56e7e2711d233f811a1cf7057283ac1cfaf1dbb4752fff08b295f0daff7989a5690f896325
-
SSDEEP
24576:h1OYdaO6MtdHAqcdDVhYwiei7+EpFAh/kKG:h1OsjPHVmVhYwiLtKkKG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
OsJNr4YZLOdpg0B.exepid process 268 OsJNr4YZLOdpg0B.exe -
Loads dropped DLL 1 IoCs
Processes:
c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exepid process 1056 c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
OsJNr4YZLOdpg0B.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebaeicihgomlmbnomlibmpjldgimgohh\2.0\manifest.json OsJNr4YZLOdpg0B.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebaeicihgomlmbnomlibmpjldgimgohh\2.0\manifest.json OsJNr4YZLOdpg0B.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebaeicihgomlmbnomlibmpjldgimgohh\2.0\manifest.json OsJNr4YZLOdpg0B.exe -
Drops file in System32 directory 4 IoCs
Processes:
OsJNr4YZLOdpg0B.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy OsJNr4YZLOdpg0B.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini OsJNr4YZLOdpg0B.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol OsJNr4YZLOdpg0B.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI OsJNr4YZLOdpg0B.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
OsJNr4YZLOdpg0B.exepid process 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe 268 OsJNr4YZLOdpg0B.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
OsJNr4YZLOdpg0B.exedescription pid process Token: SeDebugPrivilege 268 OsJNr4YZLOdpg0B.exe Token: SeDebugPrivilege 268 OsJNr4YZLOdpg0B.exe Token: SeDebugPrivilege 268 OsJNr4YZLOdpg0B.exe Token: SeDebugPrivilege 268 OsJNr4YZLOdpg0B.exe Token: SeDebugPrivilege 268 OsJNr4YZLOdpg0B.exe Token: SeDebugPrivilege 268 OsJNr4YZLOdpg0B.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exedescription pid process target process PID 1056 wrote to memory of 268 1056 c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe OsJNr4YZLOdpg0B.exe PID 1056 wrote to memory of 268 1056 c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe OsJNr4YZLOdpg0B.exe PID 1056 wrote to memory of 268 1056 c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe OsJNr4YZLOdpg0B.exe PID 1056 wrote to memory of 268 1056 c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe OsJNr4YZLOdpg0B.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe"C:\Users\Admin\AppData\Local\Temp\c57c882f738f919d1ee5707207ced76dcf644563b6b406dde273d0195ebec598.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\OsJNr4YZLOdpg0B.exe.\OsJNr4YZLOdpg0B.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\OsJNr4YZLOdpg0B.datFilesize
1KB
MD5b2001467b0dd0103ccc68f9bbd9ef2f5
SHA1b7b1c971126106c359b96152940615f0911365e4
SHA2560c677796b892099ace2a7762378a793e795a23261c46f3e30dccd5337912d636
SHA5121d77f0d09111fc9aca2ca48f6e85579c9827ab77006f0309a1a7c956124172773da5df2dff71eb1b1c1e11fb3ba8860cbbd2e639495fbd673d98e494ae0a1e91
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\OsJNr4YZLOdpg0B.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\[email protected]\chrome.manifestFilesize
35B
MD55429da3fcd4f5c58cbdcac60be85d2b8
SHA1156bd593a3f6bb697b2ed71bdc9aee7f7e0fc594
SHA256173dd6086c9f0c3b514a9be52ddab5cf408aa220f6cc4f205ec6c4d05b91b27d
SHA512fef9c2d6f2f04830fd76643d83c3ba0f5277b696572a786578ce505a0beea302653641c482c3ade839c26cb51533cbecc7badbe217efaf86923ea29df914fcbe
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5d9adcbb695fcaa1c8a605260f533ec63
SHA1b89801349b70f9e95222c822190a9141e5203b1c
SHA2564543bb83c17f30fda70e1a867946a9782912583d714f77f73a04e571c5cfe8ae
SHA512c5d2db4792386f023fb249f25cb239b336a346f89e25a78168440ec8727f1ec4031aa8e699ead3104cb568cea3c3c245a04342aa4593432674d3dbd44700fcdc
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\[email protected]\install.rdfFilesize
596B
MD52f51fb9c1251d9cc491ad06bac18373a
SHA1d61c174db7d33efce75e11ca6c6262234b7e8d24
SHA2569e32525459e1575d653fdb17f8c2b6adc1d754b96768b727d6b172b628427f51
SHA5129d5ebefda6e8c0baf5c50cde88424f086918c68d2dd5f4c2e2400a737e30bb1945184f0af9ddc66b7eec9073b1ae80c60b56985dc110b2abc91cc5133c9b859a
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\ebaeicihgomlmbnomlibmpjldgimgohh\background.htmlFilesize
147B
MD53f539e9627a2d42255100c56f79deafb
SHA1f2c8dd22deb2481ebc38e37f564c8d480af4707a
SHA256f4d3065776d069fa50a1fa2919a6b71a77b2f32f8e55f8907206ce2332707084
SHA5122083fb5a2ae4414bea06a75870b4473009689c61685cdbd667eac15277c4af2baee5255ea82e6dece255b0e569c2a59bf148f749e4b4380641c7165fd3f6f842
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\ebaeicihgomlmbnomlibmpjldgimgohh\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\ebaeicihgomlmbnomlibmpjldgimgohh\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\ebaeicihgomlmbnomlibmpjldgimgohh\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS8048.tmp\ebaeicihgomlmbnomlibmpjldgimgohh\yqCEI4DpBD.jsFilesize
6KB
MD5cd8a69ec12e9ba5f19fa3f262c51426d
SHA1a615cc7b358ac0c9621e914137762c7b8ae84d9a
SHA25690e167c8b70150033945c017c20affd9f47635095e15399dcd8264fd114ac25b
SHA5124fb72503d7ca6f69404f8c17670a38b4043ba96d70684d62b99e5eef8de435e0b395adde84a582a7868080644b3dbaa13c347cdb6a8bbfa6eb99504546e167cd
-
\Users\Admin\AppData\Local\Temp\7zS8048.tmp\OsJNr4YZLOdpg0B.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/268-56-0x0000000000000000-mapping.dmp
-
memory/1056-54-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB