c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe
Size

931KB
MD5

941d0ac30c499b0e99e2dbcacb2c1011
SHA1

b085d3315086db1d0539d2256a50d9ef199cef88
SHA256

c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9
SHA512

a9a743a2aa849e578180583d73f3aa621e4e6b617001ce6788200f11dcbf5f86070000f08c2e6907f58b4f736bdc38e505143bf11316e4774591f1de0fa7c50a
SSDEEP

24576:h1OYdaOqCZ/iWCvu/2sWsJA/jlt+DHhsX:h1OsYCpYO/dJJDHhsX

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

YrdD3haHLip9r8x.exe

pid process

1124 YrdD3haHLip9r8x.exe
Loads dropped DLL 1 IoCs

Processes:

c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe

pid process

1632 c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1632	c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe

Drops Chrome extension 3 IoCs

Processes:

YrdD3haHLip9r8x.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcmdnlkekfimnhkomjodpoolminjgelf\2.0\manifest.json	YrdD3haHLip9r8x.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcmdnlkekfimnhkomjodpoolminjgelf\2.0\manifest.json	YrdD3haHLip9r8x.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcmdnlkekfimnhkomjodpoolminjgelf\2.0\manifest.json	YrdD3haHLip9r8x.exe

Drops file in System32 directory 4 IoCs

Processes:

YrdD3haHLip9r8x.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	YrdD3haHLip9r8x.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	YrdD3haHLip9r8x.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	YrdD3haHLip9r8x.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	YrdD3haHLip9r8x.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

YrdD3haHLip9r8x.exe

pid	process
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe
1124	YrdD3haHLip9r8x.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

YrdD3haHLip9r8x.exe

description	pid	process
Token: SeDebugPrivilege	1124	YrdD3haHLip9r8x.exe
Token: SeDebugPrivilege	1124	YrdD3haHLip9r8x.exe
Token: SeDebugPrivilege	1124	YrdD3haHLip9r8x.exe
Token: SeDebugPrivilege	1124	YrdD3haHLip9r8x.exe
Token: SeDebugPrivilege	1124	YrdD3haHLip9r8x.exe
Token: SeDebugPrivilege	1124	YrdD3haHLip9r8x.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe

description	pid	process	target process
PID 1632 wrote to memory of 1124	1632	c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe	YrdD3haHLip9r8x.exe
PID 1632 wrote to memory of 1124	1632	c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe	YrdD3haHLip9r8x.exe
PID 1632 wrote to memory of 1124	1632	c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe	YrdD3haHLip9r8x.exe
PID 1632 wrote to memory of 1124	1632	c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe	YrdD3haHLip9r8x.exe

C:\Users\Admin\AppData\Local\Temp\c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe
"C:\Users\Admin\AppData\Local\Temp\c4d216cdf6586f2d23eaa329a2b060ea6fee6c19cf56abbe82ba0438965458a9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\YrdD3haHLip9r8x.exe
  .\YrdD3haHLip9r8x.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
ffe914c2735da6fef18b28c0cb8c020b

SHA1
14669f22439cf947a5a331e505693a4cc8855cfc

SHA256
6646990759dac02698539c510bcc6ab2d240c1c450353f137f60103ad75fd81e

SHA512
9d6ad3285724dd2c8da2d50558563b66c57731ef5b4825d6f9b002a2b5fdd41b9c8fc6df2a919ca35a89d0c9791bd3d65f0979315cdfe857997abe34d95c3dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
0c178de0ec673a34febf66c3f0acaa8d

SHA1
4bfe4e0adcf6e0a882e1cdf75accd3fca4fc037c

SHA256
e8edb04ba9dbaaec3229d21f45cc2f5c02852d9161c53873e6a9f30b9993c5e8

SHA512
3b3b667e3eb00b070b6e59b91411196f888fe4461ca4c640fa835ae4b0b9a9520cb85ef791c51ffa7f78b00f8b966d807377a15a28f782adeb5b54fefc97f3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\[email protected]\install.rdf

Filesize
592B

MD5
3f4e66e46d4f9cc3b1132c7d6565d941

SHA1
2385a1b892eb96df2955a6493a1bf6378ed70c2b

SHA256
7f97ed77aaadbfc08ee3bc9f99b196da8117a8d31d27d02c8d5a65516412717d

SHA512
254197cf13a2614c913dba75384b2ee4e4e6cf7c6f8ec12962a4cf3cc702762378db098251857bf8c364612792ddebcb7ba23217abb2af24bb03239953419352

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\YrdD3haHLip9r8x.dat

Filesize
1KB

MD5
42eb7fe312b3610842068a7157c937c7

SHA1
2b6b1be33d063b3463fe1447e94ac690cda729a3

SHA256
457f595ae27235d0bf7ddba8ac3b18cfbabe2dbfe5c3869d321235f3da33b77c

SHA512
56f735afaf8b8270543348bbcde58af2b18fa0e04c2d548fd720776e304fd152694c6dcdc0326df3bb2fcd631ada68156cfb10b0ae202cf3148743d7a10c5add

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\YrdD3haHLip9r8x.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\gcmdnlkekfimnhkomjodpoolminjgelf\background.html

Filesize
146B

MD5
e2a85dca07a0b99948c2d1bc9ea1ba40

SHA1
a5bdc68685634e94b2b7ad37e3f3db8ed99cd397

SHA256
5c8c9286e877edcd83a9d27b59332df6e43c74114a8f9f75d621bd1a5243824f

SHA512
d8bfed855927d55309c53abe9e5140f7ac44eb7a650362ae3ccab9bb3f5b3861912a9e289b98ca9b1b8062b3e58baa52f4d63367bf2a64c748a0e4d8fc46a3c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\gcmdnlkekfimnhkomjodpoolminjgelf\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\gcmdnlkekfimnhkomjodpoolminjgelf\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\gcmdnlkekfimnhkomjodpoolminjgelf\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF538.tmp\gcmdnlkekfimnhkomjodpoolminjgelf\vOrPgJPpv.js

Filesize
6KB

MD5
4ba0030ef2984a025b1a3a0158ebf3ed

SHA1
1fc57adad3000544b6b8e25a366717eb24ada3af

SHA256
c1d532592c173818a55410163fcee84f7409eda5b33d993df6e253665b38c9b9

SHA512
793edf1717108c8b44ba54fc5e4be340996608011b8de4669eca07d61b39628e50baa5c79cb5e6ddf5a0ba0a9703afa069bea0fe68025f8b052c1f29acd5d414

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF538.tmp\YrdD3haHLip9r8x.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1124-56-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download