Analysis
-
max time kernel
24s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe
Resource
win7-20220812-en
General
-
Target
c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe
-
Size
2.5MB
-
MD5
5ee124252f67871e50699fc79088731c
-
SHA1
35cefa1daad9a8018eb6a28c2f49b0c81bdd413a
-
SHA256
c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab
-
SHA512
9d2340043dfe72fdb51d90870de82ac44737ef5329220be56e003324ee40a9cd03a649e656e78d60e46b033e01381b9b6670ed6d23d37f450e8e166219fc4d23
-
SSDEEP
49152:h1OsbsNQH0eNGTTOxTnkSM1XN+QMz3p6bOkAk+YetEW6FOCMwEFhjzdUwP:h1OiH0eNGunkt3+1z3p6iVCM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Mexq5eI6I9mJOo9.exepid process 996 Mexq5eI6I9mJOo9.exe -
Loads dropped DLL 4 IoCs
Processes:
c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exeMexq5eI6I9mJOo9.exeregsvr32.exeregsvr32.exepid process 272 c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe 996 Mexq5eI6I9mJOo9.exe 1172 regsvr32.exe 1292 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
Mexq5eI6I9mJOo9.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjeaakkcjjgnnjjjjlnmpmfmahindpio\2.0\manifest.json Mexq5eI6I9mJOo9.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjeaakkcjjgnnjjjjlnmpmfmahindpio\2.0\manifest.json Mexq5eI6I9mJOo9.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjeaakkcjjgnnjjjjlnmpmfmahindpio\2.0\manifest.json Mexq5eI6I9mJOo9.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeMexq5eI6I9mJOo9.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} Mexq5eI6I9mJOo9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} Mexq5eI6I9mJOo9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} Mexq5eI6I9mJOo9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects Mexq5eI6I9mJOo9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ Mexq5eI6I9mJOo9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
Mexq5eI6I9mJOo9.exedescription ioc process File created C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.dat Mexq5eI6I9mJOo9.exe File opened for modification C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.dat Mexq5eI6I9mJOo9.exe File created C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dll Mexq5eI6I9mJOo9.exe File opened for modification C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dll Mexq5eI6I9mJOo9.exe File created C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.dll Mexq5eI6I9mJOo9.exe File opened for modification C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.dll Mexq5eI6I9mJOo9.exe File created C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.tlb Mexq5eI6I9mJOo9.exe File opened for modification C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.tlb Mexq5eI6I9mJOo9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Mexq5eI6I9mJOo9.exepid process 996 Mexq5eI6I9mJOo9.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exeMexq5eI6I9mJOo9.exeregsvr32.exedescription pid process target process PID 272 wrote to memory of 996 272 c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe Mexq5eI6I9mJOo9.exe PID 272 wrote to memory of 996 272 c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe Mexq5eI6I9mJOo9.exe PID 272 wrote to memory of 996 272 c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe Mexq5eI6I9mJOo9.exe PID 272 wrote to memory of 996 272 c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe Mexq5eI6I9mJOo9.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 996 wrote to memory of 1172 996 Mexq5eI6I9mJOo9.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1292 1172 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe"C:\Users\Admin\AppData\Local\Temp\c9e1c5852fd638b4d435c3db617fb5c08575bf4eb191d5f0c91f1a1026ab15ab.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\Mexq5eI6I9mJOo9.exe.\Mexq5eI6I9mJOo9.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.datFilesize
6KB
MD550ac5130d6bf0e28df24469852f0180c
SHA1d78f99ba42544186adf339dac6a3b46750df7986
SHA2562f9f823debf84b73b325c27cd559847e7403d2951256f5f08ef3351e8199cf10
SHA512aa31baeb4a9104a6279650fc86b0c2a7a53394a2b702c355c209bcca4b86e9c2a00c9cc0f25b0123f60e4d149b8ce7bf21443448bb4d5af6ec5c05be1465e7e5
-
C:\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\Mexq5eI6I9mJOo9.datFilesize
6KB
MD550ac5130d6bf0e28df24469852f0180c
SHA1d78f99ba42544186adf339dac6a3b46750df7986
SHA2562f9f823debf84b73b325c27cd559847e7403d2951256f5f08ef3351e8199cf10
SHA512aa31baeb4a9104a6279650fc86b0c2a7a53394a2b702c355c209bcca4b86e9c2a00c9cc0f25b0123f60e4d149b8ce7bf21443448bb4d5af6ec5c05be1465e7e5
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\Mexq5eI6I9mJOo9.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\Mexq5eI6I9mJOo9.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\pjeaakkcjjgnnjjjjlnmpmfmahindpio\background.htmlFilesize
141B
MD5801246f1c966d1bc77e913201fec4999
SHA1f63b9dde960ac33d8c5e965cdc01dae43c503009
SHA2560bd92f4c968b43b81ba707cbfba33d4b9181e02f4e51045c315473006840349a
SHA512b7ba6d96c00f77076331d1a094f5e9d707f90ecd6f712730a6e047142f3ebc640a2e9e76ede6f1740da222362f25d3221b43a0335fbd2e967d30c6e3b453b9e9
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\pjeaakkcjjgnnjjjjlnmpmfmahindpio\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\pjeaakkcjjgnnjjjjlnmpmfmahindpio\gc8F.jsFilesize
5KB
MD530778538c4a01dda91849578d7e2b92d
SHA19d733d543a16c1081a443ff1fce0d9afb325ab7a
SHA25613bccaadadf144f7a4d3f6d8ca37fba2eceaa20aee805f4994db11e495aee853
SHA5122eee3e372d7e8c856eb19a87eefc9146b5206301dd3d55533b9c365678c9a530dbf81b783a0aec0fd1dca93318f1528dd6f901f74c61ee7685e4a1e3c9bfb839
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\pjeaakkcjjgnnjjjjlnmpmfmahindpio\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\pjeaakkcjjgnnjjjjlnmpmfmahindpio\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\rw2WpvZq0Adbpt.dllFilesize
754KB
MD50ea14ffbf9bc129f87d5a633ca028a12
SHA1c91e00a9d6590556a4c13a46cb6c934f84cf2b2b
SHA2569206058e3e04af4fb8d5c05ae8f088cf0a289ea0e4cd692c4f2d76439adb0d47
SHA5120cfd075335346690ead8c5aef2340b56ce07c59d6243ad102fee0053d64f1a7847e56ba27f5bbcac4048f2c1cf70038e7cdffafe1cc28994603fdd65d2bf7bb2
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\rw2WpvZq0Adbpt.tlbFilesize
3KB
MD54ab2bba691d66beca01f76ac65546fe8
SHA116f05ce91f3e2fe4b43452e24d56836fc65615af
SHA25612816936003f13a1711de73328e38f311926a4cc9d1a836f46c9ccc02b6fb06f
SHA512f034390bfd57618bbfd218c3df9e465dda8f4fa51fc0445c74e246472a4cde2bc0bfe4607cbc8cb31ac0edff62a84e954179fadddc2b644b8726cfa3e01694a2
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\rw2WpvZq0Adbpt.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\x@MYRkL.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\x@MYRkL.com\chrome.manifestFilesize
35B
MD5033c599433b08298e57076767a6d024e
SHA13000e686b47672b0a472e4ca24e20721b25c5c0b
SHA256e76cdc808291591cc0e0cd0666ea9782df9a416fd863ddcb2d469c024bac77e6
SHA5127f94ac47c4f68974e27ff866a2ba6025d55aa5b94c3647e7a7beede0eb7a1be6707bcb606f7ebe5bce9bde1c825761f52627b245c2f7df791e6291a270006e08
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\x@MYRkL.com\content\bg.jsFilesize
7KB
MD506dc577003eed3fa60938ad215e9e14a
SHA1f05ec4b3d3c6f6d34ecbfeefe379fe8550c264f0
SHA256352e87ff97312f10ab4cfaa09fed0f12678d99aa837918e6527513b52f208093
SHA51243b3c9ecec3c30c81fae38ad773ae170466db31d68dac4a2f01027cf93a2a32fc0694f9e3520e30b4ce19d0581a164c16c6ab2f60d299c55bba931550b6d42f4
-
C:\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\x@MYRkL.com\install.rdfFilesize
593B
MD5746e030c95b0f409917bed34d421066d
SHA11a77c6403a9ffed74fd2ad7760922ae2591c31c4
SHA25637e57d3bd68e2762afe922dbfc4c8b5934a462151ecf935556fe50ea26c9da64
SHA5126e0ebd949d6939a3717348ce9b998ed87b7fd38111770b4f5c17e31238c25cb618119a12830dbdbc99ccb8cb8beb48b7ded764fbc6a89770e82382bdc1f1910f
-
\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.dllFilesize
754KB
MD50ea14ffbf9bc129f87d5a633ca028a12
SHA1c91e00a9d6590556a4c13a46cb6c934f84cf2b2b
SHA2569206058e3e04af4fb8d5c05ae8f088cf0a289ea0e4cd692c4f2d76439adb0d47
SHA5120cfd075335346690ead8c5aef2340b56ce07c59d6243ad102fee0053d64f1a7847e56ba27f5bbcac4048f2c1cf70038e7cdffafe1cc28994603fdd65d2bf7bb2
-
\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
\Program Files (x86)\GoSave\rw2WpvZq0Adbpt.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
\Users\Admin\AppData\Local\Temp\7zS40E8.tmp\Mexq5eI6I9mJOo9.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
memory/272-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/996-56-0x0000000000000000-mapping.dmp
-
memory/1172-73-0x0000000000000000-mapping.dmp
-
memory/1292-77-0x0000000000000000-mapping.dmp
-
memory/1292-78-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmpFilesize
8KB