Analysis
-
max time kernel
70s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe
Resource
win7-20221111-en
General
-
Target
c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe
-
Size
2.5MB
-
MD5
583b6c96d550515a54bc808374722c1a
-
SHA1
50cf6a608bad98828e962a0421a5db7c042295c2
-
SHA256
c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7
-
SHA512
15ec051b7422f8c2f0fcccdfffc4324925b2eaae33669353f3b079a48d95315a5ce82dbe28ceb8e055602a67dee51ded203a0f77276952fd7842b5498f15bd62
-
SSDEEP
49152:h1OsN+CUVCan0ytkbv/uiAY2QipuqOXMzsivHHOHNRcb83:h1O++Yan0v+QAuqOXQBvG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
0DExEEgDHl9mGcr.exepid process 960 0DExEEgDHl9mGcr.exe -
Loads dropped DLL 4 IoCs
Processes:
c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe0DExEEgDHl9mGcr.exeregsvr32.exeregsvr32.exepid process 1212 c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe 960 0DExEEgDHl9mGcr.exe 572 regsvr32.exe 1464 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
0DExEEgDHl9mGcr.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ednbgmcjngihdodmjmgniandfngjepla\2.0\manifest.json 0DExEEgDHl9mGcr.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ednbgmcjngihdodmjmgniandfngjepla\2.0\manifest.json 0DExEEgDHl9mGcr.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ednbgmcjngihdodmjmgniandfngjepla\2.0\manifest.json 0DExEEgDHl9mGcr.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
0DExEEgDHl9mGcr.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 0DExEEgDHl9mGcr.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 0DExEEgDHl9mGcr.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 0DExEEgDHl9mGcr.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 0DExEEgDHl9mGcr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ 0DExEEgDHl9mGcr.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
0DExEEgDHl9mGcr.exedescription ioc process File created C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dll 0DExEEgDHl9mGcr.exe File opened for modification C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dll 0DExEEgDHl9mGcr.exe File created C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.dll 0DExEEgDHl9mGcr.exe File opened for modification C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.dll 0DExEEgDHl9mGcr.exe File created C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.tlb 0DExEEgDHl9mGcr.exe File opened for modification C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.tlb 0DExEEgDHl9mGcr.exe File created C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.dat 0DExEEgDHl9mGcr.exe File opened for modification C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.dat 0DExEEgDHl9mGcr.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0DExEEgDHl9mGcr.exepid process 960 0DExEEgDHl9mGcr.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe0DExEEgDHl9mGcr.exeregsvr32.exedescription pid process target process PID 1212 wrote to memory of 960 1212 c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe 0DExEEgDHl9mGcr.exe PID 1212 wrote to memory of 960 1212 c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe 0DExEEgDHl9mGcr.exe PID 1212 wrote to memory of 960 1212 c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe 0DExEEgDHl9mGcr.exe PID 1212 wrote to memory of 960 1212 c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe 0DExEEgDHl9mGcr.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 960 wrote to memory of 572 960 0DExEEgDHl9mGcr.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe PID 572 wrote to memory of 1464 572 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe"C:\Users\Admin\AppData\Local\Temp\c4fe8e2500bdacea5142b5fdbab6843929f871d94e50be53931385e910892da7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\0DExEEgDHl9mGcr.exe.\0DExEEgDHl9mGcr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.datFilesize
6KB
MD5c15893b3a340ab4fe82beaa63bcc6091
SHA12dfcd0acdf2dc938f545de3fa6b4f4c98dcd39cc
SHA256d1f9f6756f63663dc90ce6ccb1677428425774088cb86e334703b19f996e426b
SHA5120d2a2bf366c386d37c614f6cb9588e5c7219f54b4dddaab24c4929d1653389b1690459b816df7b5e7ce03182cf7ee9063349626ff5ce9a1dcfead5fe3e008fe2
-
C:\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dllFilesize
881KB
MD5bbec1f94c849ac4b361307420ccdc7ca
SHA1bf13082a49dccc2aeb426965a755c981b3a6f87c
SHA256803647055a99148674a80d8b791bbf4aec502bc85aa9a579b6a0a80ca8f0de35
SHA512e0ec8717d067ca73cc0bdd0cf812f568e9c5dcd8aeb64bff00232330a46b0a16b93074cc035a93634afebf639cb9a1155c197701a9809a590af227a467d83611
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\0DExEEgDHl9mGcr.datFilesize
6KB
MD5c15893b3a340ab4fe82beaa63bcc6091
SHA12dfcd0acdf2dc938f545de3fa6b4f4c98dcd39cc
SHA256d1f9f6756f63663dc90ce6ccb1677428425774088cb86e334703b19f996e426b
SHA5120d2a2bf366c386d37c614f6cb9588e5c7219f54b4dddaab24c4929d1653389b1690459b816df7b5e7ce03182cf7ee9063349626ff5ce9a1dcfead5fe3e008fe2
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\0DExEEgDHl9mGcr.exeFilesize
770KB
MD5a82d1b7ae1c33f81f672f8854ffccd3f
SHA1d45a8ece75948bbc6f0e016a624f3000b12148fe
SHA256bbcfacae3d17e8bc208d5c7bed61c00ef8591ee27bee2ceaa94a2c1231a512fc
SHA51250192524d5e4e830e1d9f62f31ec5983bde14c09cbeab9ef75bc84617cb0ed16d51b49b7e141c87f265d3315c32cd9ea96d8dd46c640a0b7af1f1cb4ffaf5da2
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\0DExEEgDHl9mGcr.exeFilesize
770KB
MD5a82d1b7ae1c33f81f672f8854ffccd3f
SHA1d45a8ece75948bbc6f0e016a624f3000b12148fe
SHA256bbcfacae3d17e8bc208d5c7bed61c00ef8591ee27bee2ceaa94a2c1231a512fc
SHA51250192524d5e4e830e1d9f62f31ec5983bde14c09cbeab9ef75bc84617cb0ed16d51b49b7e141c87f265d3315c32cd9ea96d8dd46c640a0b7af1f1cb4ffaf5da2
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\AtYHwlKwWTtbLo.dllFilesize
749KB
MD5a8100741ab8af6097247f445cee85e1c
SHA1e8febe07d4454e884c7dda60a6310a822cac340e
SHA256893e0c1e415f5375c78b0e15020d7f70aa99c90ca439d41c57c078d1835f7f0a
SHA5123ed9740fc2f1b2943816a5785543cfda403b63fd1260df1c8ba5ec9627866c682706fd644f2daf4ee688986f25b7ee8ae56b39f2842bd837059fbfdfd5024762
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\AtYHwlKwWTtbLo.tlbFilesize
3KB
MD555036102fbe33fe4808fee8da37dfd2e
SHA16a3b76d89c42818189d05b37d9571be4b8f6b6b5
SHA256a80428e48783d869c7463688ceca06b79af826ebd208b5d10a716c88b804f18b
SHA5126da5713c4f07c38a49a4c93324365e1801b44f239444c29285ce68e9d11568449d871078edd58092b1670401bda34e424adf4d3671d10859f7351d9d45b7c272
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\AtYHwlKwWTtbLo.x64.dllFilesize
881KB
MD5bbec1f94c849ac4b361307420ccdc7ca
SHA1bf13082a49dccc2aeb426965a755c981b3a6f87c
SHA256803647055a99148674a80d8b791bbf4aec502bc85aa9a579b6a0a80ca8f0de35
SHA512e0ec8717d067ca73cc0bdd0cf812f568e9c5dcd8aeb64bff00232330a46b0a16b93074cc035a93634afebf639cb9a1155c197701a9809a590af227a467d83611
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\[email protected]\chrome.manifestFilesize
35B
MD563c96f92b1676573a2b6c7f11d2cb6b4
SHA1e97efcb23d1460b999145400f83e89c840a82c4b
SHA25604b188e26cbcaef7eb6e3f561e1340599d61938e65f5ff50555d924845d897c7
SHA512b858f4dd246cf70dcadcf7cf03e83788d2246644fad1b9ebba8c7584afd6bcddac1a80cc1c71fcd54baaa1a61f2c70e4526ebc44b1098b703a3ac08f7bd6205f
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\[email protected]\content\bg.jsFilesize
7KB
MD51adce953497d898abafa3018c6f99b39
SHA1d4a8cd9c0cc8bbe022446d4a704e13d893b92306
SHA256b9992317a59c1eb5e28c6fa38ec446cd0342a8008744ca92eb7e45e9e950b860
SHA512032fa0b95cdb8bd1a5255b77a7d281376aa8ee7cb253c7e906c2399991cfad3126ea05222f1b564e67821fe2bb4b20472f08bf482bc6a33e3d2e270fb99135d8
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\[email protected]\install.rdfFilesize
590B
MD54e58a849f707b4944efa4d2699122190
SHA1c231ca2f74962c7ebaf79aac367fd3e0bc7e6452
SHA25662d5a6d1500cfd9e6e742c80adcb8c80e44d8ab9216d1f606a2c293d01eb9e7f
SHA51200b15d947adab49bbcf5f75cc312784c98548bfbac42b1c55aac3376018867c1ea25be12c6a058ae425c1999d120249aebc3c4bc6d1c07abf1c1cda4207cd216
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\ednbgmcjngihdodmjmgniandfngjepla\background.htmlFilesize
138B
MD5f9201375cc27c6015393013cf1846e5c
SHA1d39ef1cd7d9b9083f5c91967a897e52f9db99b52
SHA256b64c7d4e0de54193ac505ae76e896ecb5eff96246766f033265f8fbc9200da85
SHA512542c90889a345282b85ae72ce4b49faa56edcd76d6b80b636966d1eecc59eb4e3adb83e4b22e717f5ff1db936b188cf41c99c44de544134f0c350a06557883c7
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\ednbgmcjngihdodmjmgniandfngjepla\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\ednbgmcjngihdodmjmgniandfngjepla\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\ednbgmcjngihdodmjmgniandfngjepla\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\ednbgmcjngihdodmjmgniandfngjepla\w.jsFilesize
5KB
MD537bf3d18300684f79dee90923244395c
SHA1837b846258a4b0fd47542101a67f7b12eb027475
SHA256fb4aea7e97da2567018b0d1ce1a5cc8bd7b4d8a8af1e39fe699b8e3c7bbf2dac
SHA5125810d1d406e805c1886ec96be28cc07fc95ba74f7c166275339c6e5fd6292de1111bb91a9c2f0212ad7f2864be136ef4230a9c39be427080938fae68818a629f
-
\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.dllFilesize
749KB
MD5a8100741ab8af6097247f445cee85e1c
SHA1e8febe07d4454e884c7dda60a6310a822cac340e
SHA256893e0c1e415f5375c78b0e15020d7f70aa99c90ca439d41c57c078d1835f7f0a
SHA5123ed9740fc2f1b2943816a5785543cfda403b63fd1260df1c8ba5ec9627866c682706fd644f2daf4ee688986f25b7ee8ae56b39f2842bd837059fbfdfd5024762
-
\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dllFilesize
881KB
MD5bbec1f94c849ac4b361307420ccdc7ca
SHA1bf13082a49dccc2aeb426965a755c981b3a6f87c
SHA256803647055a99148674a80d8b791bbf4aec502bc85aa9a579b6a0a80ca8f0de35
SHA512e0ec8717d067ca73cc0bdd0cf812f568e9c5dcd8aeb64bff00232330a46b0a16b93074cc035a93634afebf639cb9a1155c197701a9809a590af227a467d83611
-
\Program Files (x86)\GoSave\AtYHwlKwWTtbLo.x64.dllFilesize
881KB
MD5bbec1f94c849ac4b361307420ccdc7ca
SHA1bf13082a49dccc2aeb426965a755c981b3a6f87c
SHA256803647055a99148674a80d8b791bbf4aec502bc85aa9a579b6a0a80ca8f0de35
SHA512e0ec8717d067ca73cc0bdd0cf812f568e9c5dcd8aeb64bff00232330a46b0a16b93074cc035a93634afebf639cb9a1155c197701a9809a590af227a467d83611
-
\Users\Admin\AppData\Local\Temp\7zS85F3.tmp\0DExEEgDHl9mGcr.exeFilesize
770KB
MD5a82d1b7ae1c33f81f672f8854ffccd3f
SHA1d45a8ece75948bbc6f0e016a624f3000b12148fe
SHA256bbcfacae3d17e8bc208d5c7bed61c00ef8591ee27bee2ceaa94a2c1231a512fc
SHA51250192524d5e4e830e1d9f62f31ec5983bde14c09cbeab9ef75bc84617cb0ed16d51b49b7e141c87f265d3315c32cd9ea96d8dd46c640a0b7af1f1cb4ffaf5da2
-
memory/572-73-0x0000000000000000-mapping.dmp
-
memory/960-56-0x0000000000000000-mapping.dmp
-
memory/1212-54-0x0000000075E61000-0x0000000075E63000-memory.dmpFilesize
8KB
-
memory/1464-77-0x0000000000000000-mapping.dmp
-
memory/1464-78-0x000007FEFC011000-0x000007FEFC013000-memory.dmpFilesize
8KB