Analysis

  • max time kernel
    286s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 19:35

General

  • Target

    c4b4a66c7c1a8dea8fe05772282b913107779cb32bb5a6e8cbb99935b62841bd.exe

  • Size

    920KB

  • MD5

    7be9c3799dab1921f1a7c83117d15e52

  • SHA1

    071ae8edeca590b65e559ff8fd128ccbb29e0610

  • SHA256

    c4b4a66c7c1a8dea8fe05772282b913107779cb32bb5a6e8cbb99935b62841bd

  • SHA512

    dda74008d38f65b764128a5f798a2253ab231cc9b297b488c6181cad162125a13d3bed828f17f2700884632b154508153ef55ea96f38b6f03c3892d593efbe70

  • SSDEEP

    24576:h1OYdaOSMtdHAqcdDVhYwiei7+EpFAh/kKX:h1OsTPHVmVhYwiLtKkKX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops Chrome extension 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4b4a66c7c1a8dea8fe05772282b913107779cb32bb5a6e8cbb99935b62841bd.exe
    "C:\Users\Admin\AppData\Local\Temp\c4b4a66c7c1a8dea8fe05772282b913107779cb32bb5a6e8cbb99935b62841bd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\50bBs0WICCzKmP6.exe
      .\50bBs0WICCzKmP6.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2292

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\50bBs0WICCzKmP6.dat

    Filesize

    1KB

    MD5

    0ef9a990d2e50c64cfede56362ff3275

    SHA1

    57b10fc3be84275dfeb77a53d92fff0eeb7b7b77

    SHA256

    177247282f3a271a370ed3bacc9ea53591bb3da47573bf0e35b0339566106fcb

    SHA512

    0c0f9cf528672ecb809f7a0137e656ea1616c6c29370bab4330a735b19b5a155c1d5fc081f2827dfcef3141effb373ff9fd16f37d241fdaa637060ae69ae5fa4

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\50bBs0WICCzKmP6.exe

    Filesize

    760KB

    MD5

    dcd148f6f3af3e3b0935c4fcc9f41811

    SHA1

    ee9bdbc7c568c7832d90b85921ab20030b6734cd

    SHA256

    f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

    SHA512

    34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\50bBs0WICCzKmP6.exe

    Filesize

    760KB

    MD5

    dcd148f6f3af3e3b0935c4fcc9f41811

    SHA1

    ee9bdbc7c568c7832d90b85921ab20030b6734cd

    SHA256

    f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

    SHA512

    34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\cmjhmoecimcccnliplegdhbocnhjonog\background.html

    Filesize

    144B

    MD5

    34cf663600d059b787bb29f62b6856d7

    SHA1

    01620557c9ddd4ffdc5669c9dbf6cff20c55b4f9

    SHA256

    f7445e357c29e91dfc6a8491d55aa8d6ea6b2aec6328883ba3596bc8fe72203a

    SHA512

    75b27570722844c91ad6707f4b2743e5d7cb62433a7eb0e77aa31236ec583bbea77a32890a645460a2ed0111e7b90a5c80bea481b1669954c9af429bb45d6827

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\cmjhmoecimcccnliplegdhbocnhjonog\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\cmjhmoecimcccnliplegdhbocnhjonog\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\cmjhmoecimcccnliplegdhbocnhjonog\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\cmjhmoecimcccnliplegdhbocnhjonog\saQncv6.js

    Filesize

    6KB

    MD5

    20920d438fab157f4443c1bf28c4d3a9

    SHA1

    378a40373deb6326db095f2a673279d1715de3d3

    SHA256

    bc08ad74b714c7ee1f8083c28e7c1d3f08e5ce4f788a627f3946f6e90ce1bf32

    SHA512

    0961ef18cfe90868d4c6a6a8cf25063ed4b53a2e6b104d771cfb19bb928222f9a06a0d619c564c18016443afc54c0dc3d3660d5f35a1a5fb3000100ccbfaa66d

  • memory/2292-132-0x0000000000000000-mapping.dmp