Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:16
Static task
static1
Behavioral task
behavioral1
Sample
ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe
Resource
win7-20220812-en
General
-
Target
ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe
-
Size
920KB
-
MD5
d8a826b2b6f6c8b1300ca5945fb177fb
-
SHA1
91f857745e41aa9663b67cd41c0835f7ad125896
-
SHA256
ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde
-
SHA512
2a4d8f0be21efcdc311ee6418bcaefeb7425426fede73903eda04c832b3534f52ccdd75a2a7c059ac36e63d7cbcb6b52cadd99ded7c5f7a10b8fba6b660f3cce
-
SSDEEP
24576:h1OYdaOAMtdHAqcdDVhYwiei7+EpFAh/kKx:h1OslPHVmVhYwiLtKkKx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
EqD8kAflMy3qjfU.exepid process 1072 EqD8kAflMy3qjfU.exe -
Loads dropped DLL 1 IoCs
Processes:
ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exepid process 1092 ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
EqD8kAflMy3qjfU.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhgfpbebojaibpamhbdiddjkmbkompl\2.0\manifest.json EqD8kAflMy3qjfU.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhgfpbebojaibpamhbdiddjkmbkompl\2.0\manifest.json EqD8kAflMy3qjfU.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhgfpbebojaibpamhbdiddjkmbkompl\2.0\manifest.json EqD8kAflMy3qjfU.exe -
Drops file in System32 directory 4 IoCs
Processes:
EqD8kAflMy3qjfU.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI EqD8kAflMy3qjfU.exe File opened for modification C:\Windows\System32\GroupPolicy EqD8kAflMy3qjfU.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini EqD8kAflMy3qjfU.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol EqD8kAflMy3qjfU.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
EqD8kAflMy3qjfU.exepid process 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe 1072 EqD8kAflMy3qjfU.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
EqD8kAflMy3qjfU.exedescription pid process Token: SeDebugPrivilege 1072 EqD8kAflMy3qjfU.exe Token: SeDebugPrivilege 1072 EqD8kAflMy3qjfU.exe Token: SeDebugPrivilege 1072 EqD8kAflMy3qjfU.exe Token: SeDebugPrivilege 1072 EqD8kAflMy3qjfU.exe Token: SeDebugPrivilege 1072 EqD8kAflMy3qjfU.exe Token: SeDebugPrivilege 1072 EqD8kAflMy3qjfU.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exedescription pid process target process PID 1092 wrote to memory of 1072 1092 ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe EqD8kAflMy3qjfU.exe PID 1092 wrote to memory of 1072 1092 ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe EqD8kAflMy3qjfU.exe PID 1092 wrote to memory of 1072 1092 ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe EqD8kAflMy3qjfU.exe PID 1092 wrote to memory of 1072 1092 ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe EqD8kAflMy3qjfU.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe"C:\Users\Admin\AppData\Local\Temp\ca31f7e6b0baa2932cfb7097eeba7e05cdaf60645369070c18d6bb2daf112fde.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\EqD8kAflMy3qjfU.exe.\EqD8kAflMy3qjfU.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\EqD8kAflMy3qjfU.datFilesize
1KB
MD5cab4d278abcbd4f37e604828bd08a513
SHA16cef2c806401d7bd4d89f1ab7777b7e258ea39dd
SHA256e4f2c4ef4dc68c6b1f099a0869c1978f50aafeac2b22f002aecc3a054a8c9ea5
SHA512e7d9f5d027b2e45aa93e3307522ddd90356c09971fa9cabebac63d7c15ba7ba7066fb3f4c10fb7b8f84eab98b8b76542cb27916412a3c2690876c26f61b5a8a2
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\EqD8kAflMy3qjfU.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\SH@T.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\SH@T.net\chrome.manifestFilesize
35B
MD529a023e7cd556fbf16c75da9c0ab302e
SHA14a07b2c903e9fb0acc02b577245dd5b4dd51af35
SHA2561434b77cdfb19d2ebe78c4d9be1f566525349ab3d8a794ca4d255dcd10897da7
SHA5121b40c07d7a7a9f96a0788387cb1cff68ece5c50f2a84261641babea056075ace5371b1dec523599193172861aee973a6708b9e69dc11e4aafe26e86780a03d52
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\SH@T.net\content\bg.jsFilesize
8KB
MD5900b832812ecf779a3748791b8071b13
SHA12e60b623db051eb6cd01aa4d1192679eb637e319
SHA2562b6af96b25e87c9abe9d928ef35de6e7957a57855ad5c5ee0b3efbdadf3edc9f
SHA5120722e3af3414b0eb1dfa80454c205c8d849521f5d6c3876f89709b357413e3f91f21a9f38713d7e499f2e0e17db754382c2bb2307d76017879d736db1157aff0
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\SH@T.net\install.rdfFilesize
591B
MD50496b1bcf32bd717fe9436a1899100de
SHA1f294a12fd4db349677b06a95801311798af0653f
SHA256485cd235421b75c490c13f7b05b2d3f03d4e0a77e1cad821c4de40d0027a52bf
SHA51213b4a1d151daa4abfd210ab9bd09cb13b1a22da2267437c2aacf091b6e1557958e46781b4a022b3d35e4f5756fda5c826e89f2249517e164becdfdcda6314195
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\pfhgfpbebojaibpamhbdiddjkmbkompl\L0vjuqcdr.jsFilesize
6KB
MD5ca8866165cb5ff471e0fe9f782a23169
SHA102850aa7a5c793e27f9294b1c13910b23e5202e3
SHA2563a330b83d67e3424ea2c5884f01c801a89f15b8a193742aa6a6ebad5048b2e04
SHA5125b9798fe0e6c2c67c64b29a4797aab55a780d06755450538cafad2610ad9353407259487067171cfbddc40bae7cb5dd2405640d01f4e40d24766a8e4be89ffa0
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\pfhgfpbebojaibpamhbdiddjkmbkompl\background.htmlFilesize
146B
MD5ec4463b493a96cf2f77a64e8d6cb7273
SHA139af9f5448edd60f1f932a812fc6105075b0a511
SHA2564d88be0519f534b045271c3130b6fe91160bfabf7703d8f39f6af14892f0ed7f
SHA512e032291f5960f82d86057b57bedcfd58e12e6fdf6b4fa47d6d99eeba4b36a8a860fbb3da653f4c919de5aa38e4badb52d9531341f9a6e8c9f30cd8e4254ad42c
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\pfhgfpbebojaibpamhbdiddjkmbkompl\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\pfhgfpbebojaibpamhbdiddjkmbkompl\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\pfhgfpbebojaibpamhbdiddjkmbkompl\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zSA4E.tmp\EqD8kAflMy3qjfU.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1072-56-0x0000000000000000-mapping.dmp
-
memory/1092-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB