Analysis

  • max time kernel
    44s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 18:58

General

  • Target

    cf8e308b792229cde00a37ae204cf5b4e5938a520a9b43d89036fc3208d0965e.exe

  • Size

    931KB

  • MD5

    c481b4fa9ff2d82c73f6278346ece961

  • SHA1

    dbdf55425fed11c8b60231a8eec1aef93b1598e8

  • SHA256

    cf8e308b792229cde00a37ae204cf5b4e5938a520a9b43d89036fc3208d0965e

  • SHA512

    e7ab7e34c58dd32021d635c3fdbe6772149a7ebd0c46970a8d8d71c26ddddffae1366e46bc43e2ec92249fb518ae9d38473880bc180cf8cee22c6ae08273fdc1

  • SSDEEP

    24576:h1OYdaOICZ/iWCvu/2sWsJA/jlt+DHhsa:h1OseCpYO/dJJDHhsa

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf8e308b792229cde00a37ae204cf5b4e5938a520a9b43d89036fc3208d0965e.exe
    "C:\Users\Admin\AppData\Local\Temp\cf8e308b792229cde00a37ae204cf5b4e5938a520a9b43d89036fc3208d0965e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\b72BiFcu9i2f8QG.exe
      .\b72BiFcu9i2f8QG.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\b72BiFcu9i2f8QG.dat
    Filesize

    1KB

    MD5

    23c58f77f3887056bbffc46af27ff2f5

    SHA1

    bfd1b3ef4452d6f12039fec90d1399dd2ad9efbe

    SHA256

    79787e9e6a16fe334f097d86f31ef9a4ebd33e9d5158ed02ed16eb83c08073a8

    SHA512

    853c473dd9e8528100ca924cb0e633bab6ae4155b363e0ff86137993ab064f5d576113b0ce51424044633cf854753c8d0cc1e24077506c39c7a18d97dd1ddfc2

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\b72BiFcu9i2f8QG.exe
    Filesize

    772KB

    MD5

    5ed7019dcd0008dbcd8e54017b8c7dd9

    SHA1

    7e4457da2ff06c2170bad636c9eb7c1bb436fd06

    SHA256

    7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

    SHA512

    10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\jkombflincbdngohkfeefnmalfjlibec\WC2p6Oj9.js
    Filesize

    6KB

    MD5

    bf485a68d22433d83894f2d2028961a3

    SHA1

    03b323feabae788cb52cf57ebadd5a12ecd18e06

    SHA256

    f78a599fab1c32f02dc906c02afd762f34057bafbdf2dfdca5876bf042e9918b

    SHA512

    275579f979abf7db9781260b09a251b4acb86fc75e388b066f1d0b8aeb2fec84d01df5d60c5a119ff472c8b103088c3b820d9d684a68671adb42ba35f37a1cfa

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\jkombflincbdngohkfeefnmalfjlibec\background.html
    Filesize

    145B

    MD5

    290d39f392abeeeaea8c590fa9d38817

    SHA1

    c8c8c26093b64b5781e67ccca5f0a537cf079747

    SHA256

    8562b9a8c17c447aaf0c5c220c0bb19679037951bcf0a685dccfb7905082c6e5

    SHA512

    9b5c2a9ee69c071f208fd6c1d9fdc31cfcd005f8562c25579eb611343f3f2fac16f6dba0d22fc52f8834b0b2ac927f140d4f69b033ec42c826fd0322db0376a8

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\jkombflincbdngohkfeefnmalfjlibec\content.js
    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\jkombflincbdngohkfeefnmalfjlibec\lsdb.js
    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\jkombflincbdngohkfeefnmalfjlibec\manifest.json
    Filesize

    498B

    MD5

    664e2884e17f23553a19eee317642194

    SHA1

    a28ccc088d6b6692646150f3e8f111e568723fb4

    SHA256

    ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

    SHA512

    b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\vz@Ez.com\bootstrap.js
    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\vz@Ez.com\chrome.manifest
    Filesize

    35B

    MD5

    178d719e2aad915995a81bac04b761cf

    SHA1

    1ccc1e3793a69e4ef97d731f8d2fbd792ead8246

    SHA256

    e7960c0692bc2ef3758b2e87fa4b5b3b5ba47c986deb2fc65e6cdf9da0715662

    SHA512

    8351ea6871bd9df97746ed364bf86e4b5c4fc553df11bd8ab3e3ffb99eae458b80bb546dfb1867c2cc17b53e6c014e36d5d8312541e0403f6aeb4cd4ce981366

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\vz@Ez.com\content\bg.js
    Filesize

    9KB

    MD5

    2fed2b0e15f0d51e49fb3dd890c9524e

    SHA1

    850a4f28ba1c1ce49c20b403fb3211762060203a

    SHA256

    06f3b9ce61d2e0594782e9241cf2812b284412e865483c3cf8bbabf6fe42dc2c

    SHA512

    ad412b46c37a1c50f3f3f6cb7bd15a9e56bd1510a03580731bf8b21970958b7d9ff36d8c4cf5975923eedd064ca570e9653d8672cfbd211418b6ea326c9013da

  • C:\Users\Admin\AppData\Local\Temp\7zS26F2.tmp\vz@Ez.com\install.rdf
    Filesize

    591B

    MD5

    a696a7a56e907586fef2b199182edc52

    SHA1

    746b2bea5ccd7b69ecf897ad75d3b2f2c1fd0c8f

    SHA256

    e8adc086373b5542c9879e0f8756686b02f77c2464c347e1d3d37b5af9f85007

    SHA512

    e1423f6913e05f855d81319fde0f1a4367575e874387e6b1204956bcdc01191b42229c9114e75447f442d218c8852aa2138c2c55b7d45f708e1c45e7f2fa75f6

  • \Users\Admin\AppData\Local\Temp\7zS26F2.tmp\b72BiFcu9i2f8QG.exe
    Filesize

    772KB

    MD5

    5ed7019dcd0008dbcd8e54017b8c7dd9

    SHA1

    7e4457da2ff06c2170bad636c9eb7c1bb436fd06

    SHA256

    7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

    SHA512

    10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

  • memory/1464-54-0x00000000758B1000-0x00000000758B3000-memory.dmp
    Filesize

    8KB

  • memory/1752-56-0x0000000000000000-mapping.dmp