Analysis
-
max time kernel
49s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe
Resource
win7-20221111-en
General
-
Target
c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe
-
Size
2.5MB
-
MD5
61e4e0587b7cfa04581a53c9136b3465
-
SHA1
bf1830d86af35779a4ec0de75d4156c715240072
-
SHA256
c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637
-
SHA512
e8fb4245498e2fbc493c503f0bef6ed0b5d3d71b8725c4514def4b6e81aaa42be488fc055cff2bc507aff206db11286a00860d3284e2edebbb22df319e004e29
-
SSDEEP
49152:h1Os8IPtchP5IawtcvlV3COH8qA0OOMC1gqEaejGfrn:h1OrIPtrkvlBCOHgBCj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
J1Z7uQDaudxt7uM.exepid process 1208 J1Z7uQDaudxt7uM.exe -
Loads dropped DLL 4 IoCs
Processes:
c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exeJ1Z7uQDaudxt7uM.exeregsvr32.exeregsvr32.exepid process 1184 c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe 1208 J1Z7uQDaudxt7uM.exe 468 regsvr32.exe 656 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
J1Z7uQDaudxt7uM.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jiglpommobhoobldigbmjjdkndgpcfji\1.0\manifest.json J1Z7uQDaudxt7uM.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jiglpommobhoobldigbmjjdkndgpcfji\1.0\manifest.json J1Z7uQDaudxt7uM.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jiglpommobhoobldigbmjjdkndgpcfji\1.0\manifest.json J1Z7uQDaudxt7uM.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeJ1Z7uQDaudxt7uM.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} J1Z7uQDaudxt7uM.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} J1Z7uQDaudxt7uM.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects J1Z7uQDaudxt7uM.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ J1Z7uQDaudxt7uM.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} J1Z7uQDaudxt7uM.exe -
Drops file in Program Files directory 8 IoCs
Processes:
J1Z7uQDaudxt7uM.exedescription ioc process File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.tlb J1Z7uQDaudxt7uM.exe File created C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.dat J1Z7uQDaudxt7uM.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.dat J1Z7uQDaudxt7uM.exe File created C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dll J1Z7uQDaudxt7uM.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dll J1Z7uQDaudxt7uM.exe File created C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.dll J1Z7uQDaudxt7uM.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.dll J1Z7uQDaudxt7uM.exe File created C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.tlb J1Z7uQDaudxt7uM.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
J1Z7uQDaudxt7uM.exepid process 1208 J1Z7uQDaudxt7uM.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exeJ1Z7uQDaudxt7uM.exeregsvr32.exedescription pid process target process PID 1184 wrote to memory of 1208 1184 c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe J1Z7uQDaudxt7uM.exe PID 1184 wrote to memory of 1208 1184 c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe J1Z7uQDaudxt7uM.exe PID 1184 wrote to memory of 1208 1184 c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe J1Z7uQDaudxt7uM.exe PID 1184 wrote to memory of 1208 1184 c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe J1Z7uQDaudxt7uM.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 1208 wrote to memory of 468 1208 J1Z7uQDaudxt7uM.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 656 468 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe"C:\Users\Admin\AppData\Local\Temp\c9c3835751c274bdea48ae098026e8476bfdef4b0f34bb2477772093ef38d637.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\J1Z7uQDaudxt7uM.exe.\J1Z7uQDaudxt7uM.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.datFilesize
6KB
MD5a0b0b3f3a38200c55544dd87842af79d
SHA194ff0118e17cb7a4857c2ea21c024d72c51e5b94
SHA2565899c7e05cb0030536652408e712f3324a93dfd7e7564498079ec1b544eb17ba
SHA512ce89e77d0a897f91977530e1ff1e736c136422d2a886010b59f8891b4e083bd09e73476518158fcd78af3a1861138fe7d8f17ef49f93d31fb21aed58bbd0dd0a
-
C:\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dllFilesize
881KB
MD58cb4c5980306da615fd3a3c0b7124d95
SHA104c3ab5e547e3644e8627f9a548a56c112792499
SHA256ce12f2e485306ea9a8bd019ffd6a62d846259bac4ba0ec71d81b43ab32470d43
SHA5121852f4cf028c72869f215a8efff6c7244e2c67cde1230eb633a0d700fce957774dade7a50fcd7b760f395b3e242a5701ab88496e5551f778d208bcf182e0bedf
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\297cWyvllEGjL3.dllFilesize
747KB
MD5075a34d90e4395f320b3266b2a6cc2c0
SHA1c04c7386f13b45f5cc8424109d369e1e2427e5ec
SHA25682550996793875d5d60d0479968dd63ff127ac705aca610110bc3f6ca127e8dc
SHA5122618fb83c62bfd2ea6925d15417a86144d0133c1db3d6020b93ff6bac19adf47c1d31a10fcc31010e0fd6c2bd6f0a4537763715c57b74ad094ce8d6aedbf896a
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\297cWyvllEGjL3.tlbFilesize
3KB
MD580b66ebf00d9d7c1904175c81cf3b1e1
SHA125edfc73c30f45e1254ddec9bdc5854d0f5c3c1b
SHA2565691ef6a5460131e8fbebeed40d4f0fb81ff49e25a08d45df2178bb8d486672a
SHA512396db976a5a56df11be3f46e16908341b33be7b374c92674550a563885012c056b7213ab873745e98bf4681bf12882632260363c578105decda25a2d249fdb9d
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\297cWyvllEGjL3.x64.dllFilesize
881KB
MD58cb4c5980306da615fd3a3c0b7124d95
SHA104c3ab5e547e3644e8627f9a548a56c112792499
SHA256ce12f2e485306ea9a8bd019ffd6a62d846259bac4ba0ec71d81b43ab32470d43
SHA5121852f4cf028c72869f215a8efff6c7244e2c67cde1230eb633a0d700fce957774dade7a50fcd7b760f395b3e242a5701ab88496e5551f778d208bcf182e0bedf
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\J1Z7uQDaudxt7uM.datFilesize
6KB
MD5a0b0b3f3a38200c55544dd87842af79d
SHA194ff0118e17cb7a4857c2ea21c024d72c51e5b94
SHA2565899c7e05cb0030536652408e712f3324a93dfd7e7564498079ec1b544eb17ba
SHA512ce89e77d0a897f91977530e1ff1e736c136422d2a886010b59f8891b4e083bd09e73476518158fcd78af3a1861138fe7d8f17ef49f93d31fb21aed58bbd0dd0a
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\J1Z7uQDaudxt7uM.exeFilesize
787KB
MD57b2176326be202922b35e876bab7ff83
SHA1e7e8a0feb3fd78413b5c6d636a72bd28254bcea8
SHA256292a3ad5628c78a7956e3ff9e30e484453ca674ced5a37894415eef1055051c4
SHA512369d238f1118fe730bb49e44058999e0afca237d722ac68e3272c8e9ad27e97c368c8380f7d0c35a233ad44341e4f368fdb8a385f9b82789c1266a9b0024dd69
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\J1Z7uQDaudxt7uM.exeFilesize
787KB
MD57b2176326be202922b35e876bab7ff83
SHA1e7e8a0feb3fd78413b5c6d636a72bd28254bcea8
SHA256292a3ad5628c78a7956e3ff9e30e484453ca674ced5a37894415eef1055051c4
SHA512369d238f1118fe730bb49e44058999e0afca237d722ac68e3272c8e9ad27e97c368c8380f7d0c35a233ad44341e4f368fdb8a385f9b82789c1266a9b0024dd69
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\b@jX.edu\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\b@jX.edu\chrome.manifestFilesize
35B
MD58ec4700d22c7c4e16df7b37ce038a7b0
SHA107c993135bb34c45bb6ed8b2c73a09be0fcf9f19
SHA256e13b9407c5f975c6a66c22d9ac19e93e916c619e320d6801c218f08444344f70
SHA5127212889f09312fa3071cb0cf744955680938f997de9a2953336bd47974cf6971e35873720e14145a3c568e8b8cc683f276aec186edaf3f0b141f152311a4bbc8
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\b@jX.edu\content\bg.jsFilesize
7KB
MD5a385d7c97cb179fb49753be2164c4b40
SHA1290ab74f43ad20e8380a67f2bc56ba5f0deb4c45
SHA256e9260e6a474f13a59096290172e60851e51795ecefb7500841e5084ae5925515
SHA512d40fe9301610d659aa82f1ca2c36a32b6f0b0994e0285fea54aa8317a1feae4f502915508b7d998dcb29cf21730968b2e422b590746a45cd89ee3815ea6650db
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\b@jX.edu\install.rdfFilesize
599B
MD56b5f193f1d8035b4a2d3dbc2d9151066
SHA165adef26cdacdfe1a8a0f41c574e524d7a554115
SHA256367630e72a8723cfd9b55a91e082c3427cb1b3949cb4ef48ff571a065c45d3d5
SHA512991eb117ccb20154d0212e9c6846e772e96a909a45b7d60b16e793485021f95780a426fa8c57dddfde987c80d5de34962f8a43b776171b8e45ef2581c39c1099
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\jiglpommobhoobldigbmjjdkndgpcfji\background.htmlFilesize
146B
MD56917192e894334a9de1e4ce204a76155
SHA1b5482f5facfccd62bd30afe05265848f6d6614a7
SHA256f1163dd0bb1376daa85e78b0c1fa3c85c82069a37e83e66a92ae0a0b9f04c079
SHA512111d13033a95a05f9846f32e06a9186bad27c97db2abb83ea34d4248c5e8d4a77e580bf2c8828ad2c66f6460baff7d03af8a333924a6a2f588b73e7b3f378376
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\jiglpommobhoobldigbmjjdkndgpcfji\bhc6ut4HY.jsFilesize
5KB
MD5449f3bd0c257ae0cf514775cc8d725b3
SHA1a7d8fd0c7a346943ade121265d6ed8e47887d154
SHA256413b4205f1043da7ab534076a1f89b532e7fd9cb5006402b90352ecaae68678f
SHA512ca88a7797ebb7f0168506f940d168fe4c87afce0c802b909a237ecd1ab2f06e00749eb5ff89c72f6bc616ad90162816c7e0c4317e2c642134f830c7e642dd28a
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\jiglpommobhoobldigbmjjdkndgpcfji\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\jiglpommobhoobldigbmjjdkndgpcfji\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\jiglpommobhoobldigbmjjdkndgpcfji\manifest.jsonFilesize
507B
MD5d429395a45a9aa09e4ee9054e9196b30
SHA1c5dbab4e27650b07d4d159c305d08a9d578c3a3e
SHA256674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344
SHA5124a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e
-
\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.dllFilesize
747KB
MD5075a34d90e4395f320b3266b2a6cc2c0
SHA1c04c7386f13b45f5cc8424109d369e1e2427e5ec
SHA25682550996793875d5d60d0479968dd63ff127ac705aca610110bc3f6ca127e8dc
SHA5122618fb83c62bfd2ea6925d15417a86144d0133c1db3d6020b93ff6bac19adf47c1d31a10fcc31010e0fd6c2bd6f0a4537763715c57b74ad094ce8d6aedbf896a
-
\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dllFilesize
881KB
MD58cb4c5980306da615fd3a3c0b7124d95
SHA104c3ab5e547e3644e8627f9a548a56c112792499
SHA256ce12f2e485306ea9a8bd019ffd6a62d846259bac4ba0ec71d81b43ab32470d43
SHA5121852f4cf028c72869f215a8efff6c7244e2c67cde1230eb633a0d700fce957774dade7a50fcd7b760f395b3e242a5701ab88496e5551f778d208bcf182e0bedf
-
\Program Files (x86)\YoutubeAdBlocke\297cWyvllEGjL3.x64.dllFilesize
881KB
MD58cb4c5980306da615fd3a3c0b7124d95
SHA104c3ab5e547e3644e8627f9a548a56c112792499
SHA256ce12f2e485306ea9a8bd019ffd6a62d846259bac4ba0ec71d81b43ab32470d43
SHA5121852f4cf028c72869f215a8efff6c7244e2c67cde1230eb633a0d700fce957774dade7a50fcd7b760f395b3e242a5701ab88496e5551f778d208bcf182e0bedf
-
\Users\Admin\AppData\Local\Temp\7zS8CD5.tmp\J1Z7uQDaudxt7uM.exeFilesize
787KB
MD57b2176326be202922b35e876bab7ff83
SHA1e7e8a0feb3fd78413b5c6d636a72bd28254bcea8
SHA256292a3ad5628c78a7956e3ff9e30e484453ca674ced5a37894415eef1055051c4
SHA512369d238f1118fe730bb49e44058999e0afca237d722ac68e3272c8e9ad27e97c368c8380f7d0c35a233ad44341e4f368fdb8a385f9b82789c1266a9b0024dd69
-
memory/468-73-0x0000000000000000-mapping.dmp
-
memory/656-78-0x0000000000000000-mapping.dmp
-
memory/656-79-0x000007FEFB7C1000-0x000007FEFB7C3000-memory.dmpFilesize
8KB
-
memory/1184-54-0x0000000075991000-0x0000000075993000-memory.dmpFilesize
8KB
-
memory/1208-56-0x0000000000000000-mapping.dmp