c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4

Analysis

max time kernel
32s
max time network
97s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe
Size

932KB
MD5

83f849fcc5f697eeecf00afb7cbac816
SHA1

f7667b75b595a0aa5aa3d8fa4b1f1f1524346dcf
SHA256

c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4
SHA512

3f84f0f2ebbe09e9cb85a1180c9d3fb082132fded7a262c2089411b7bb736694214ac06a9c5cf00a65121ff8091407fd64488b87f73f4b954f3fd3863565bd0c
SSDEEP

12288:h1OgLdaOKkTDU/eJcLvR8DBjnm/StTcVKMe5oHNUKobzN8IPMp:h1OYdaOF4nwjztTAKMe5oHpobzN8IPMp

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

q1MrRpESJAqA5oV.exe

pid process

2024 q1MrRpESJAqA5oV.exe
Loads dropped DLL 1 IoCs

Processes:

c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe

pid process

1152 c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1152	c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe

Drops Chrome extension 3 IoCs

Processes:

q1MrRpESJAqA5oV.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\2.0\manifest.json	q1MrRpESJAqA5oV.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\2.0\manifest.json	q1MrRpESJAqA5oV.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\2.0\manifest.json	q1MrRpESJAqA5oV.exe

Drops file in System32 directory 4 IoCs

Processes:

q1MrRpESJAqA5oV.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	q1MrRpESJAqA5oV.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	q1MrRpESJAqA5oV.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	q1MrRpESJAqA5oV.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	q1MrRpESJAqA5oV.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

q1MrRpESJAqA5oV.exe

pid	process
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe
2024	q1MrRpESJAqA5oV.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

q1MrRpESJAqA5oV.exe

description	pid	process
Token: SeDebugPrivilege	2024	q1MrRpESJAqA5oV.exe
Token: SeDebugPrivilege	2024	q1MrRpESJAqA5oV.exe
Token: SeDebugPrivilege	2024	q1MrRpESJAqA5oV.exe
Token: SeDebugPrivilege	2024	q1MrRpESJAqA5oV.exe
Token: SeDebugPrivilege	2024	q1MrRpESJAqA5oV.exe
Token: SeDebugPrivilege	2024	q1MrRpESJAqA5oV.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe

description	pid	process	target process
PID 1152 wrote to memory of 2024	1152	c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe	q1MrRpESJAqA5oV.exe
PID 1152 wrote to memory of 2024	1152	c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe	q1MrRpESJAqA5oV.exe
PID 1152 wrote to memory of 2024	1152	c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe	q1MrRpESJAqA5oV.exe
PID 1152 wrote to memory of 2024	1152	c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe	q1MrRpESJAqA5oV.exe

C:\Users\Admin\AppData\Local\Temp\c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe
"C:\Users\Admin\AppData\Local\Temp\c9fe7a0358f7d16b13851ff3f65a5ac0baba1207b3ce72ad8a70180b016d5ff4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152

C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\q1MrRpESJAqA5oV.exe
.\q1MrRpESJAqA5oV.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\e5s98@ByNp1.net\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\e5s98@ByNp1.net\chrome.manifest
Filesize
35B

MD5
7254194785c042d0f352be30d2e48b77

SHA1
b806e105c69274719767317ac642e303d9dd177a

SHA256
7cbabb7376d756be71603dcfbb7f1f98e691b92c929e3f433b6077d6b9311b56

SHA512
d4aaf8f9ed8b330c71d9b152574b9f051d207e690eccf9d9994f28baca5a19db74e62b8f464c5b9dfba46e8768ffb2bca27eef46cde8e90488b918aadbea480b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\e5s98@ByNp1.net\content\bg.js
Filesize
8KB

MD5
8786fd39709fb470ac99d05fba1c0c0d

SHA1
b03a222cc474d0db146b71ff03e405d70c7b6add

SHA256
e8cfdacf0772abb1bccda8074449f57b3bedbe75cf53038a1cafc50a5ef25195

SHA512
cb164a74e3b8fbc3e201dcea28e670cb74480d6c3e99cf80696c0f442554752a9c9b6dcc9544d772bcc5d188c4fc1f430a7224812d57cd91fc130b7b132e9b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\e5s98@ByNp1.net\install.rdf
Filesize
597B

MD5
dbc2ffc9567ddad9796ac1fbdf6f9efa

SHA1
d922999573a8b373a9e8c0573d70da83dad5af84

SHA256
85132732ee465b3ca9a63da54ee39333696f2ac657147e6df36192ed3e74960c

SHA512
5668fd7dbbfccef12061040acf07a3e5ea21ca530e6c5d0d0284c5cbae7f9cb830c7b03a8774e06ca9956e0d2862bcf672eb3e2c48ac228d2a2820d20a4b57d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\background.html
Filesize
145B

MD5
84d706337257198dbff3304e64b81f15

SHA1
68ac0e2371a3af2ec8ea5a83c21f47cec031c3af

SHA256
84be8ad7fdaf031007881eec3f80f52419eac6fd6f94df21dc8ab2ed6fafa16e

SHA512
34d71c548d18ffd167c3c88be5f315a24c67b336b4bccc11b1391813b7b0738508067e283c45428666f23eb7fa290d060c2d1b3c856509f5c5dca041e5ec617a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\hkniidhbkfkbjkcdfhkbojbfdkhlidcf\sKdCeSRu.js
Filesize
6KB

MD5
71ab9f54e690f54c3c6d09f3ff518dc4

SHA1
a86e2f875d0f5d580e88d90322daf750b94050f0

SHA256
9c9ffaadf6138ef3b978899514e9c8947c6bcfe2fa3b1b32b4806520e1b57b01

SHA512
760cf932289804f62ebd3cafcbfc7f5f6a9bf83e541998fe112a862c76f1834b1e67b7d26a99c5138d1e10b11959ec986004ef4fd288bd38555142d6d8ec6a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\q1MrRpESJAqA5oV.dat
Filesize
1KB

MD5
50523db1990590e9f98d1596ed1f97f0

SHA1
ba1062885481f82007c6f0773cf9e9cfdd05a537

SHA256
98a26aac9fa3d909015f388d2643326811b1d35439641e90d52dabfef58a1489

SHA512
c13f02380ab77a5715d26f3833649e5fe837e471a7249f13ab32200391c48c8e2b7231cce3d93428eb374bef5191037797cdb3b8b15da6fe230e0bff5e630a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\q1MrRpESJAqA5oV.exe
Filesize
772KB

MD5
4abcac1eb111b2788f36023711e193e0

SHA1
c8e24c1a58cd988446d33797421c6049f6aab0c4

SHA256
c54b01f36010744726e69c473ab871f3dd0503333a428fa09d7216c3c3d1d661

SHA512
ee17678d90889efd8ed5541d0fb718df71cc9a4bc38247b93404a50974bfab521a16224c05ee883b350c8e4d85b00bf99a5a8441644d95acc94529d22970650e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1018.tmp\q1MrRpESJAqA5oV.exe
Filesize
772KB

MD5
4abcac1eb111b2788f36023711e193e0

SHA1
c8e24c1a58cd988446d33797421c6049f6aab0c4

SHA256
c54b01f36010744726e69c473ab871f3dd0503333a428fa09d7216c3c3d1d661

SHA512
ee17678d90889efd8ed5541d0fb718df71cc9a4bc38247b93404a50974bfab521a16224c05ee883b350c8e4d85b00bf99a5a8441644d95acc94529d22970650e

Download Submit
memory/1152-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/2024-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads