c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe
Size

931KB
MD5

10f42dd92bdcb49e300c5290d52c9010
SHA1

0d12da3442ba7b570c1daf02c731388186539e64
SHA256

c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2
SHA512

1a108dd9001f32fff0ebb8f06ef57dd36ace643f31c1a6aba725d11c23b0135a84f7d6c86a7e03e4554869ed6bd638fd879c0e5c2c4d757f82c45df0b668383c
SSDEEP

24576:h1OYdaO4CZ/iWCvu/2sWsJA/jlt+DHhsW:h1Os6CpYO/dJJDHhsW

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

9x66NysKdylcfsA.exe

pid process

4548 9x66NysKdylcfsA.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

9x66NysKdylcfsA.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\maecedfihcbcfkkkfongleedngpojglp\2.0\manifest.json	9x66NysKdylcfsA.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\maecedfihcbcfkkkfongleedngpojglp\2.0\manifest.json	9x66NysKdylcfsA.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\maecedfihcbcfkkkfongleedngpojglp\2.0\manifest.json	9x66NysKdylcfsA.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\maecedfihcbcfkkkfongleedngpojglp\2.0\manifest.json	9x66NysKdylcfsA.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\maecedfihcbcfkkkfongleedngpojglp\2.0\manifest.json	9x66NysKdylcfsA.exe

Drops file in System32 directory 4 IoCs

Processes:

9x66NysKdylcfsA.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	9x66NysKdylcfsA.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	9x66NysKdylcfsA.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	9x66NysKdylcfsA.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	9x66NysKdylcfsA.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

9x66NysKdylcfsA.exe

pid	process
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe
4548	9x66NysKdylcfsA.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

9x66NysKdylcfsA.exe

description	pid	process
Token: SeDebugPrivilege	4548	9x66NysKdylcfsA.exe
Token: SeDebugPrivilege	4548	9x66NysKdylcfsA.exe
Token: SeDebugPrivilege	4548	9x66NysKdylcfsA.exe
Token: SeDebugPrivilege	4548	9x66NysKdylcfsA.exe
Token: SeDebugPrivilege	4548	9x66NysKdylcfsA.exe
Token: SeDebugPrivilege	4548	9x66NysKdylcfsA.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe

description	pid	process	target process
PID 1924 wrote to memory of 4548	1924	c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe	9x66NysKdylcfsA.exe
PID 1924 wrote to memory of 4548	1924	c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe	9x66NysKdylcfsA.exe
PID 1924 wrote to memory of 4548	1924	c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe	9x66NysKdylcfsA.exe

C:\Users\Admin\AppData\Local\Temp\c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe
"C:\Users\Admin\AppData\Local\Temp\c5cc6e4a0add687b5a94f961fff3d2af14ee91ddc16459397f995a3a89101ef2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\9x66NysKdylcfsA.exe
.\9x66NysKdylcfsA.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\3@l.co.uk\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\3@l.co.uk\chrome.manifest
Filesize
35B

MD5
6f3f3ddae55c459aa5fd541f99ea2cd5

SHA1
cac5fb793d6cff4aa1adb78c729e599f05d600cd

SHA256
ba83f095e0bdeeb9ac94e20bda060dbc4ebb0db7b6335e095cd532abd7e6bc47

SHA512
496f251af6a2907be89db15f415e788c40df50af291f6739ccce8318d13047b127cca8fb833fc314984c4cd3fbad9ed207afd2313066c0fbabe2e29eefc1d631

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\3@l.co.uk\content\bg.js
Filesize
8KB

MD5
e9da64036621b060b98174fbeeec6551

SHA1
cf0746e7c8896c5026073054cab35e8bd88dfb75

SHA256
13a55f3808c30d18bb2d771cf527f4813333a27522e4a13f553a26d9fb1a2f04

SHA512
f8db0ebbd7ec3df7ecf8e9750162b3af7756a52fefc726c564208f3318041dcc96663710715d29657e041e15c580022672ed0ba8fba92abf70669f0419ce60bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\3@l.co.uk\install.rdf
Filesize
591B

MD5
21e7938f8506b2fd76eaf7a0414e43cf

SHA1
d51de164ec13fd83de3088f94a5a39dcdfb72e86

SHA256
1c9ef058e165dcf4700d920b1e8a18a46db66bb0d3143ae5fd5f0b3370ff45f2

SHA512
78d70183ef381f289958c6188706f43d1488657cb2c0a3b01bd90714343ae3092c1da157ba1921baa01604b3a4197bcb616d11095e3b161152aec13b2d8cfb71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\9x66NysKdylcfsA.dat
Filesize
1KB

MD5
2316996e425a141170fba0963d353f9c

SHA1
e87a7780286a507c52bcf41860f8f83dd69e51bb

SHA256
4860fe71389a32b0c2ed8e1f3c00c8e237398a1a41e81c5547ea85ced90b3a3e

SHA512
97b994cce239b877a4171d11dd5858873c96728da35d0435e05a5e1eea6e9d95eb64131dfadad7f78063e5a65625306b4f0637bcfd97bfee6bd2781e6e823a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\9x66NysKdylcfsA.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\9x66NysKdylcfsA.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\maecedfihcbcfkkkfongleedngpojglp\background.html
Filesize
140B

MD5
29af2ae5c5dd1b35717862e4a7928b5e

SHA1
bae157ac39fd11f409c967ca608e093ba9a39b8f

SHA256
3e2623bb6112073d9829cc13ac02a62e442c4073134401d2e52cf0501602bf7e

SHA512
5dc644e8872cb5d45c356b998fe7e753933f6c78a812027ba53793c28533630d16cb7c243eb9d0ba5f7e09573059447474bec0a36bae9382d1df0c50651c523e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\maecedfihcbcfkkkfongleedngpojglp\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\maecedfihcbcfkkkfongleedngpojglp\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\maecedfihcbcfkkkfongleedngpojglp\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C5.tmp\maecedfihcbcfkkkfongleedngpojglp\tr2.js
Filesize
6KB

MD5
4a20e87b3eb1b732405ee2007f58c3b6

SHA1
b3b95ee99787e2b739bf9448d247e3211389512f

SHA256
5c338ca5a6a259a2b4188dfc633e94c84d32e920ba380a4a749004f5f2add462

SHA512
91eac92704899a9e9cc9778b258602f7206e2f0b412be53ed94311c1d2af97c909e111f6709bc4de804e2e2f69f263376ddb21519deae39c2a610f122a8a9e85

Download Submit
memory/4548-132-0x0000000000000000-mapping.dmp

Download