Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe
Resource
win10v2004-20221111-en
General
-
Target
c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe
-
Size
2.5MB
-
MD5
03c055fe9da892d6127f8f5fafb39321
-
SHA1
306889ff5deaee4fe2238be6b986ff002b594275
-
SHA256
c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d
-
SHA512
c70dd382d62eabec16edd0c87ea222e17c279b09f0a25a9dce6a41504a5f6440a01d6b301d02a19ef696fbf2c8805bbc6196d66feaa92675e93125b507ad7ea8
-
SSDEEP
49152:h1OsbjtPNg3MaK+715e2Yl8Wd7dZcRGzPbXO2mg6P1Ql5PPLKMRnUDs:h1OojVNI71i86pZbz55PPLKMRUY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
4aCIML2ITZSx8Zu.exepid process 988 4aCIML2ITZSx8Zu.exe -
Loads dropped DLL 4 IoCs
Processes:
c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe4aCIML2ITZSx8Zu.exeregsvr32.exeregsvr32.exepid process 2024 c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe 988 4aCIML2ITZSx8Zu.exe 1880 regsvr32.exe 456 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
4aCIML2ITZSx8Zu.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmanmkeocgonjaaekeamomcjdgbkkmak\1.3\manifest.json 4aCIML2ITZSx8Zu.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmanmkeocgonjaaekeamomcjdgbkkmak\1.3\manifest.json 4aCIML2ITZSx8Zu.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmanmkeocgonjaaekeamomcjdgbkkmak\1.3\manifest.json 4aCIML2ITZSx8Zu.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
4aCIML2ITZSx8Zu.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 4aCIML2ITZSx8Zu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 4aCIML2ITZSx8Zu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 4aCIML2ITZSx8Zu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 4aCIML2ITZSx8Zu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ 4aCIML2ITZSx8Zu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
4aCIML2ITZSx8Zu.exedescription ioc process File opened for modification C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.dat 4aCIML2ITZSx8Zu.exe File created C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dll 4aCIML2ITZSx8Zu.exe File opened for modification C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dll 4aCIML2ITZSx8Zu.exe File created C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.dll 4aCIML2ITZSx8Zu.exe File opened for modification C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.dll 4aCIML2ITZSx8Zu.exe File created C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.tlb 4aCIML2ITZSx8Zu.exe File opened for modification C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.tlb 4aCIML2ITZSx8Zu.exe File created C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.dat 4aCIML2ITZSx8Zu.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4aCIML2ITZSx8Zu.exepid process 988 4aCIML2ITZSx8Zu.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe4aCIML2ITZSx8Zu.exeregsvr32.exedescription pid process target process PID 2024 wrote to memory of 988 2024 c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe 4aCIML2ITZSx8Zu.exe PID 2024 wrote to memory of 988 2024 c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe 4aCIML2ITZSx8Zu.exe PID 2024 wrote to memory of 988 2024 c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe 4aCIML2ITZSx8Zu.exe PID 2024 wrote to memory of 988 2024 c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe 4aCIML2ITZSx8Zu.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 988 wrote to memory of 1880 988 4aCIML2ITZSx8Zu.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe PID 1880 wrote to memory of 456 1880 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe"C:\Users\Admin\AppData\Local\Temp\c55bd737a87397f77393945614bc8d1fba6bf04c91f20855462b2db2b5c8268d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\4aCIML2ITZSx8Zu.exe.\4aCIML2ITZSx8Zu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.datFilesize
6KB
MD5dc16d0c95c8506562f39892978f1e30b
SHA19d10c7b0397e67a337140a92dc888e6cace4f70e
SHA256a6a6dd3538e82ec0cf7839a6e6c34c583f7b99a0b4d0cdf2b79f6c270d979f31
SHA512273a88cbabc9829d7e864f8b9c9674d85db8d910d1bdb58c879a87db866e30902679687a90df3dc3fd606361f2c636805a61538dffdbffeb05d4ae65f90051f7
-
C:\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\4aCIML2ITZSx8Zu.datFilesize
6KB
MD5dc16d0c95c8506562f39892978f1e30b
SHA19d10c7b0397e67a337140a92dc888e6cace4f70e
SHA256a6a6dd3538e82ec0cf7839a6e6c34c583f7b99a0b4d0cdf2b79f6c270d979f31
SHA512273a88cbabc9829d7e864f8b9c9674d85db8d910d1bdb58c879a87db866e30902679687a90df3dc3fd606361f2c636805a61538dffdbffeb05d4ae65f90051f7
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\4aCIML2ITZSx8Zu.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\4aCIML2ITZSx8Zu.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\[email protected]\chrome.manifestFilesize
35B
MD533030dc3d81875c6d297068c98af8000
SHA1277b3c7ab28ddecf8ad5c82cd72aa6501a7f91a2
SHA256bd572a43366ad4fb983893dd4efd0711a5753eb448282841bc80e0dbf28d0dc4
SHA512a0d806f27aea550a8c2d0221bf8ab76b4e1afd0ea707c5e517f95d7873aec1dc1ac495ac814ba622d48335bc2ccbbaef1b43eb75855782b3e9f39fa41beff74b
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\[email protected]\content\bg.jsFilesize
7KB
MD5db789b673d18c63cb5c7d2d5a079fe25
SHA193c597d2b3c625d5e90536f5fdc87f28a575b978
SHA25668fc4ccaa59f35e0622272c4b76ab31927fcdc4bc9478ee6a0d805308a2815de
SHA51279ae519d4fc70218e914d9ae6a19540e1a2c4e302c4bda2ebd5fd7f10f34857042d44f6e7611cc2d508f43a1d1f794310f72054b11cfff2e7357f544ffa9628e
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\[email protected]\install.rdfFilesize
596B
MD57ad962fcfa6abcec8a516de65e2b14ed
SHA1c882ba1401e062bf36c0554ba88a597e8bc37322
SHA25672d6132b00e2a2bf74b01adc73354840ed908b9222833a3e06b248c0d330135a
SHA5126b0a2d8d422076a9ebe2c79b2bbfb990c203f3a38c1c1bc75024ac7aca461e05e29469f06a10fa165d88384da2b8066df142c04a58a18c87d71e83bf7a408cb7
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\hmanmkeocgonjaaekeamomcjdgbkkmak\background.htmlFilesize
145B
MD53f722f0a29f227bc3128a8bb8a9feeb7
SHA13bcbc9bdf985554d24785fb20a10532a157cca93
SHA256dad4a115c443875f682bcefab54fafd6c60092aea6d2d226d9735a836b7c96a6
SHA5125c5736a85d292dc6ede29701acad5dcfe310d8147324f3066266e62c2d7f1dde3648cb76b63b3a50b4c2fc596b0996a16253b0e34476be60e8a189d97b8f825b
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\hmanmkeocgonjaaekeamomcjdgbkkmak\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\hmanmkeocgonjaaekeamomcjdgbkkmak\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\hmanmkeocgonjaaekeamomcjdgbkkmak\manifest.jsonFilesize
498B
MD5664e2884e17f23553a19eee317642194
SHA1a28ccc088d6b6692646150f3e8f111e568723fb4
SHA256ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191
SHA512b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\hmanmkeocgonjaaekeamomcjdgbkkmak\opHOsl9D.jsFilesize
5KB
MD5c69e4e944a2e0dfefce2acba0a19d2fb
SHA10c09aa13ec85c24d3524a0d320f72d7402bb3486
SHA25691a1ee808cc7bbc68e58f54bb21974562e8c83833dd0eb38dd301ae8bdd1c59f
SHA51258a2a8b593720e370b3dbc9425635e22ee83f25c4e50f16ee04a9ce7f13232661367ffb7a09989eee44a100c4c73d4db5be0436a0b3e901b726b27ce7159cf6f
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\pCIQiosa6oDGs3.dllFilesize
741KB
MD502955857b45fa9ddd4229b9d67f65d93
SHA1a5fe5c71d62bd9648ab25660d7cae6eff98af3ed
SHA256839e59c1dd9fa6ce4ed8b4b964b32a3afdd5b6b621580c47cdad754868abe753
SHA5120b0c6a7754abead8aec777a1ee4330f4c5ee90aebde30266e6ad93f356f91abbe4a2bc3fdc924556edb82c3b4bd0f97191e72d6039bed14975d5e5b940af3261
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\pCIQiosa6oDGs3.tlbFilesize
3KB
MD575846c93e1f5b9d77fcc4520a65b4936
SHA1f4631b5f768bfa33063a96c7a0da478c1fb28791
SHA256c6843974e37a7eb67c2e6550cec7ffd63645d80f4bd9613430e5824b4604b08b
SHA512a51876207191e351f955e614be727f9b0141cce69d46f7bbf141a632306fe277de3372848c5b707da525d22bafca044b0a73c544a2a670d4056d33f37f7b328c
-
C:\Users\Admin\AppData\Local\Temp\7zS983.tmp\pCIQiosa6oDGs3.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.dllFilesize
741KB
MD502955857b45fa9ddd4229b9d67f65d93
SHA1a5fe5c71d62bd9648ab25660d7cae6eff98af3ed
SHA256839e59c1dd9fa6ce4ed8b4b964b32a3afdd5b6b621580c47cdad754868abe753
SHA5120b0c6a7754abead8aec777a1ee4330f4c5ee90aebde30266e6ad93f356f91abbe4a2bc3fdc924556edb82c3b4bd0f97191e72d6039bed14975d5e5b940af3261
-
\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Program Files (x86)\Vaudix\pCIQiosa6oDGs3.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Users\Admin\AppData\Local\Temp\7zS983.tmp\4aCIML2ITZSx8Zu.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
memory/456-78-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmpFilesize
8KB
-
memory/456-77-0x0000000000000000-mapping.dmp
-
memory/988-56-0x0000000000000000-mapping.dmp
-
memory/1880-73-0x0000000000000000-mapping.dmp
-
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB