c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f

Analysis

max time kernel
315s
max time network
338s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe
Size

931KB
MD5

61d7c00f2a63af3c8bbd77b2760e83d2
SHA1

2a9d9a21733b718103b1d98e06c6366f13da2c2d
SHA256

c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f
SHA512

f484ac22b2dc63db69f9b6b0141a64484f5a8a264b2be9dbe897e0b5f51527cebf86e44de35099d9fb94f13a223d527c41158ec59b4d50e012146f9ebe805ca8
SSDEEP

24576:h1OYdaOCCZ/iWCvu/2sWsJA/jlt+DHhsM:h1Os8CpYO/dJJDHhsM

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

htaXgDVBtZ2xRfU.exe

pid process

872 htaXgDVBtZ2xRfU.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

htaXgDVBtZ2xRfU.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbfblabonmkeeciahcabfilanlhblkd\2.0\manifest.json	htaXgDVBtZ2xRfU.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbfblabonmkeeciahcabfilanlhblkd\2.0\manifest.json	htaXgDVBtZ2xRfU.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbfblabonmkeeciahcabfilanlhblkd\2.0\manifest.json	htaXgDVBtZ2xRfU.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbfblabonmkeeciahcabfilanlhblkd\2.0\manifest.json	htaXgDVBtZ2xRfU.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbfblabonmkeeciahcabfilanlhblkd\2.0\manifest.json	htaXgDVBtZ2xRfU.exe

Drops file in System32 directory 4 IoCs

Processes:

htaXgDVBtZ2xRfU.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	htaXgDVBtZ2xRfU.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	htaXgDVBtZ2xRfU.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	htaXgDVBtZ2xRfU.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	htaXgDVBtZ2xRfU.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

htaXgDVBtZ2xRfU.exe

pid	process
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe
872	htaXgDVBtZ2xRfU.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

htaXgDVBtZ2xRfU.exe

description	pid	process
Token: SeDebugPrivilege	872	htaXgDVBtZ2xRfU.exe
Token: SeDebugPrivilege	872	htaXgDVBtZ2xRfU.exe
Token: SeDebugPrivilege	872	htaXgDVBtZ2xRfU.exe
Token: SeDebugPrivilege	872	htaXgDVBtZ2xRfU.exe
Token: SeDebugPrivilege	872	htaXgDVBtZ2xRfU.exe
Token: SeDebugPrivilege	872	htaXgDVBtZ2xRfU.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe

description	pid	process	target process
PID 4680 wrote to memory of 872	4680	c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe	htaXgDVBtZ2xRfU.exe
PID 4680 wrote to memory of 872	4680	c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe	htaXgDVBtZ2xRfU.exe
PID 4680 wrote to memory of 872	4680	c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe	htaXgDVBtZ2xRfU.exe

C:\Users\Admin\AppData\Local\Temp\c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe
"C:\Users\Admin\AppData\Local\Temp\c43aa166c28fe9cbf6bbc085e4ab1875ee883d5b4f3fecc3220229923f0c855f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\htaXgDVBtZ2xRfU.exe
.\htaXgDVBtZ2xRfU.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\htaXgDVBtZ2xRfU.dat
Filesize
1KB

MD5
8843ec1540f6dd2693030326f586da42

SHA1
5c4adef4a7f58f02f750f767ad35f66131cf1089

SHA256
1ee4fdccf24878608bfed422f281ee4f624710cfb8944ba0315d5ccf5f8a7f28

SHA512
36f22866337d6e266e182b382e9029456a025c7ce111e92deb0be81fef377d27c77c0bbf5e63e7008190b5e0abb7b2f7dd57c738058a9c0ee83895bdfceceb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\htaXgDVBtZ2xRfU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\htaXgDVBtZ2xRfU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\pkbfblabonmkeeciahcabfilanlhblkd\background.html
Filesize
145B

MD5
5eac5c23e79b35c9ead19128e2b2a50c

SHA1
1212eaf1514a34956fd2f6f3470c6b17d442082d

SHA256
7babb4c1f29cbf3f99a589840996cf7fea5d31d963b808accec41e175a0bb0cd

SHA512
9e3ee12ba287d90551423792243c43da9cec7a7410677b531044b1b1144945de97f844871df1d0f606bff630c3e55368f3880777c7fc25b8c2eba485e0e4185c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\pkbfblabonmkeeciahcabfilanlhblkd\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\pkbfblabonmkeeciahcabfilanlhblkd\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\pkbfblabonmkeeciahcabfilanlhblkd\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\pkbfblabonmkeeciahcabfilanlhblkd\vOb5Me2s.js
Filesize
6KB

MD5
9c236b479510558eb446d99f8aa9ec6d

SHA1
03be6c427481c2016187459eef234e7248b51d68

SHA256
1f3e3b591c16019d6c01605d6e7a4c7c82bd4c7d532fb69d8db729b746a62613

SHA512
cdb1601b25b1389cd1a36d2a4cb8b8aebfae29b6d1be25ef2289b2f1d2d48beb7fbac62a940164aa52f2a4fa35f4bd08451f834e378ca3442a94e7e1a4ba5097

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
df6426a2ba2ab62ca2229e958a42e07a

SHA1
e24524d7c4f674cfdc918281b5c9c9aec89d6bc3

SHA256
24f17dca2981c84482520761a0d515d0ecf68833e314d729dca3af140b458feb

SHA512
224403bce927b8b9915866afe12aae2d891657680f5286c8b9c348c7a7e5e8312cc9cf0cb33e7bdfb09fb5f87cae6c2f667b5808e8a2903c68a6b850c43015ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
fa5a84c522139631761731521e21df71

SHA1
f506d2c4fe5914e30d000e22789a7b5825bd050e

SHA256
b2dd2226e18ad8c570ac32d87d3350692e545565497cd23fcfe9c7ad639bf86a

SHA512
14b5cc3668b16dced9b51daaf809519fe4f420039f1e0d3ebd5c771aad9e2e6359428a8c05727a3464818cb9cd8a0ef0b48d31e93cab0ce8e23c3edd7767684e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS37DF.tmp\[email protected]\install.rdf
Filesize
591B

MD5
c8ee221120f0f3cefc73e5899582d3b5

SHA1
100e19e625b6da963abe189266197814fcdee62e

SHA256
3510e0bc16394261ceaaf2163f8ceedfca088852065031116e252743076ad7a5

SHA512
3f5ab54c97e5e126a33a47a8d7b240bce965d663b15471b2255f6c013577f8c3e0e5aff5a260ee7c95f83ee97add86606f5efcdb32d9d7be760120e330182e89

Download Submit
memory/872-132-0x0000000000000000-mapping.dmp

Download