c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe
Size

931KB
MD5

d375add59c80589d577e8260a4e50317
SHA1

42f5bdafbd200edf9d8de4f8e7d4d1e76635c2d7
SHA256

c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b
SHA512

be560766e109fc80b0b54a5376138cf5e15ba9211bbee4e7f2a0c2bf1c95ec3b3e673953835e419b01f8981cd1b38646d722072d648bb8d419431c1246cdc763
SSDEEP

24576:h1OYdaO/CZ/iWCvu/2sWsJA/jlt+DHhs1:h1OsRCpYO/dJJDHhs1

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

aXknP0QhuIul8wy.exe

pid process

1912 aXknP0QhuIul8wy.exe
Loads dropped DLL 1 IoCs

Processes:

c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe

pid process

1904 c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1912	aXknP0QhuIul8wy.exe

pid	process
1904	c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe

Drops Chrome extension 3 IoCs

Processes:

aXknP0QhuIul8wy.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpdonhflclpfmekfpngadjcfpahibeed\2.0\manifest.json	aXknP0QhuIul8wy.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpdonhflclpfmekfpngadjcfpahibeed\2.0\manifest.json	aXknP0QhuIul8wy.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpdonhflclpfmekfpngadjcfpahibeed\2.0\manifest.json	aXknP0QhuIul8wy.exe

Drops file in System32 directory 4 IoCs

Processes:

aXknP0QhuIul8wy.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	aXknP0QhuIul8wy.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	aXknP0QhuIul8wy.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	aXknP0QhuIul8wy.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	aXknP0QhuIul8wy.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

aXknP0QhuIul8wy.exe

pid process

1912 aXknP0QhuIul8wy.exe
1912 aXknP0QhuIul8wy.exe
1912 aXknP0QhuIul8wy.exe
1912 aXknP0QhuIul8wy.exe

pid	process
1912	aXknP0QhuIul8wy.exe
1912	aXknP0QhuIul8wy.exe
1912	aXknP0QhuIul8wy.exe
1912	aXknP0QhuIul8wy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe

description	pid	process	target process
PID 1904 wrote to memory of 1912	1904	c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe	aXknP0QhuIul8wy.exe
PID 1904 wrote to memory of 1912	1904	c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe	aXknP0QhuIul8wy.exe
PID 1904 wrote to memory of 1912	1904	c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe	aXknP0QhuIul8wy.exe
PID 1904 wrote to memory of 1912	1904	c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe	aXknP0QhuIul8wy.exe

C:\Users\Admin\AppData\Local\Temp\c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe
"C:\Users\Admin\AppData\Local\Temp\c4667ba1c0c4aeda00cc0d8fc6e8ef0625aa934ce664a03da7352e725504c82b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\aXknP0QhuIul8wy.exe
.\aXknP0QhuIul8wy.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1912

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
1e7556d9f779d34de0a26e1663d88a3d

SHA1
effca0b35a0b749f6c3f3c607851602512a1b730

SHA256
baafa732d06585b8efb01dd49458f14fb97bcf117dbb231a8fdad278bb503380

SHA512
590324cd67b97e3ed1878e0ab128550750fc7b945bf7feaa4c1d35cb0f2656e3f763a250086f4f6563a6dc3fe376d70de848c6e9239e29e41eda439534665d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
0324dc0472614ecb163e171c7c9fe9e6

SHA1
de3cede49e9fce4ced323dde1e1ce8ce7c54eddb

SHA256
cb8a702a5c83bfcd2ece6c2d662238d451f88febec23a4b3ae93943151fdb0b9

SHA512
33505b06902bdcb032a7d4c7281a7e15f0b5fbc15edacde83c12124d1d11e444ab4233d30cae7e5fe3f4a39fc56f6454f2f03a46cf291f82fe63282c707ca7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\[email protected]\install.rdf
Filesize
595B

MD5
62aeebe207409a138a7cf1e131136c6d

SHA1
296bb8be535155e895276d5134fcea06bea8cdcf

SHA256
a89c9c61aa498e4b767b4f3129e078669197cc3c6d59d1e1e204fb9c3c75f11d

SHA512
238ddd3da085b9bfbd88db30827756b74896469999281b5f8c309ca53e904c9b05cb00f68a952d66abc9a11688c70f0ec6d3deead7456d9f6d429a6fe5c89259

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\aXknP0QhuIul8wy.dat
Filesize
1KB

MD5
bc7db2debe65a05cc79530ad808cbb84

SHA1
adddef7069bc4ac2556343be375663064fb9c820

SHA256
303a944d9c170b05e2eb565413a980e429a5e9237c40ea2f1b42779353fba1b2

SHA512
c98c0f9b92380ab070f9a62b1a9c1aae60ffc3e2e6656fb7dc1bdcae478b3a4812299467258b3be9089dbfdbd4ab691e5bd19377d88d77015338299c68a35f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\aXknP0QhuIul8wy.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\aXknP0QhuIul8wy.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\mpdonhflclpfmekfpngadjcfpahibeed\background.html
Filesize
145B

MD5
31c8c9457f7d1ca79291476b9b020348

SHA1
a4cd8576921e813607ada0fc32fcb817565eb59f

SHA256
b48c7d7de4381d15223d6765d534d8a4975905e3ebec144045a864d3a64288c4

SHA512
3c988de6c5956642642b201eed8d9f78c8d3fe5203267228c93b354c8c9e728fcceacedac718dbd4e42df92c473e3ebab229aaab087775489d09648a2bc0cf28

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\mpdonhflclpfmekfpngadjcfpahibeed\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\mpdonhflclpfmekfpngadjcfpahibeed\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\mpdonhflclpfmekfpngadjcfpahibeed\manifest.json
Filesize
501B

MD5
05edf5ac117c006abc1847e8b5331f6c

SHA1
e0f45e5897a8967ef33599b72e7fdf3beb72d239

SHA256
b133bb8163ec7bb48118724f8d3e8eac8f9da6c579ac65a2b5aaa1b9653b6c18

SHA512
9607b0c9c0add5c85403532aad754f8b51ecbb134b0a5e54bdcc26c8185eee26fff39ad420e905b9e014b5c2518949ca1f4a7c26ae987e3e4d0853aba2d878c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4683.tmp\mpdonhflclpfmekfpngadjcfpahibeed\wV2algLt.js
Filesize
6KB

MD5
805eab3a04dd3d5d93d8d37058cbd0c4

SHA1
e18d4aac74659faaa9e8853fa60029c300017ba0

SHA256
5b2555242483f53639bbfca8a865fdb3c27bbe6afb96689ee638fb1e7a0ba6f9

SHA512
83c038b31549121b9b4d5359d12f214cefc273075bff1067fe38c723bbfdb9cae5df9796a72e67540c1d99a0cd280e7b3e3d182bb3a99b283649f2dfbc8d2f95

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4683.tmp\aXknP0QhuIul8wy.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1904-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1912-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads