Analysis
-
max time kernel
123s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:36
Static task
static1
Behavioral task
behavioral1
Sample
c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe
Resource
win7-20221111-en
General
-
Target
c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe
-
Size
932KB
-
MD5
b6e20267eda11afa01a3e5531d46a338
-
SHA1
754e60ffd4766c9526d6a2c9427d523452756e42
-
SHA256
c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055
-
SHA512
23998d2f09a7da1fa10ef55aea03c57d715b89a80e66035ff85da6e6e19ba1eab1cdd26d99ab8080a3a10d35f00c2208d0c3a8cfe0c4e62c934932bdb8a8ae9a
-
SSDEEP
24576:h1OYdaOiCZ/iWCvu/2sWsJA/jlt+DHhsT:h1OsMCpYO/dJJDHhsT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
A9H17dPUOCTbUyz.exepid process 4792 A9H17dPUOCTbUyz.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
A9H17dPUOCTbUyz.exedescription ioc process File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibhlbcnojmeeipfnocmkppehdjoipjan\2.0\manifest.json A9H17dPUOCTbUyz.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibhlbcnojmeeipfnocmkppehdjoipjan\2.0\manifest.json A9H17dPUOCTbUyz.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibhlbcnojmeeipfnocmkppehdjoipjan\2.0\manifest.json A9H17dPUOCTbUyz.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibhlbcnojmeeipfnocmkppehdjoipjan\2.0\manifest.json A9H17dPUOCTbUyz.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibhlbcnojmeeipfnocmkppehdjoipjan\2.0\manifest.json A9H17dPUOCTbUyz.exe -
Drops file in System32 directory 4 IoCs
Processes:
A9H17dPUOCTbUyz.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy A9H17dPUOCTbUyz.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini A9H17dPUOCTbUyz.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol A9H17dPUOCTbUyz.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI A9H17dPUOCTbUyz.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
A9H17dPUOCTbUyz.exepid process 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe 4792 A9H17dPUOCTbUyz.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
A9H17dPUOCTbUyz.exedescription pid process Token: SeDebugPrivilege 4792 A9H17dPUOCTbUyz.exe Token: SeDebugPrivilege 4792 A9H17dPUOCTbUyz.exe Token: SeDebugPrivilege 4792 A9H17dPUOCTbUyz.exe Token: SeDebugPrivilege 4792 A9H17dPUOCTbUyz.exe Token: SeDebugPrivilege 4792 A9H17dPUOCTbUyz.exe Token: SeDebugPrivilege 4792 A9H17dPUOCTbUyz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exedescription pid process target process PID 2836 wrote to memory of 4792 2836 c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe A9H17dPUOCTbUyz.exe PID 2836 wrote to memory of 4792 2836 c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe A9H17dPUOCTbUyz.exe PID 2836 wrote to memory of 4792 2836 c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe A9H17dPUOCTbUyz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe"C:\Users\Admin\AppData\Local\Temp\c40b77aba5a2963bb905a90ad49d42004e05f5ff115d0bd24e051529e2118055.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\A9H17dPUOCTbUyz.exe.\A9H17dPUOCTbUyz.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\A9H17dPUOCTbUyz.datFilesize
1KB
MD5b15d6af4c5847287825c7f6f4a7a3085
SHA118d9b878b0dbab9ece820bb92ac33609c4f24dc4
SHA256cd9a08b95e66a97336fa2a9bcf70346162a6ea119356f39654cfb513f260d49b
SHA5123ebe5ed3eeeb7fcea52d47dfd4c306a50873566965e4702e87aa4511d2981db0c120940696a07d1d6b4c840298cdff9084695801f7391da85c235c20fb36e0b0
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\A9H17dPUOCTbUyz.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\A9H17dPUOCTbUyz.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\[email protected]\chrome.manifestFilesize
35B
MD560057f9b3b78f09afbe2fe25c9068d7f
SHA169112ad369267471c2640f13a82948038add5246
SHA256db710603223829003219e1b07939215b9f8a7948f99514a66c62b59fa72c9d26
SHA5122e19fabdd05f089be6fccc018f75eccc784793066274b7193f7f304d2c8828be8243087c8c19a7cc74df2a34b3e63273e16dac92e63dfc358614399f092b52a8
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\[email protected]\content\bg.jsFilesize
9KB
MD508fc45da105a0ec7462f8cedff07906a
SHA1a1b625d25d443559f9cc85451dac8ef704175f91
SHA256fd332826580730f023d355626433b7edb750b3477c058b7708716ecd554766d6
SHA51284560345be1ee592e02f86ecf32b09612b65928d6e4491de3f3d7c0cafa937d63704b94e89f9573ae4060dfc74bc4c410c2016ba308b8d457347f227574a14b0
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\[email protected]\install.rdfFilesize
593B
MD5cc8b8c4bce49162b8ed4ce0868ed3980
SHA10027e30ee9748e7911e49b51953a04bd488b1240
SHA2566e26aff88ec038aa2ab0c2e15f99fcc8ffc346d0ecf9503c5d17bf44a699c944
SHA512340f98489c8328d858960e9541165d20fb246bcc4224d62c7a3e7f3eb9eeccae3043f9fb43fcb8ce61abf1c1a0f8b2795b29d2950a92d96cd2e3c79db8849151
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\ibhlbcnojmeeipfnocmkppehdjoipjan\R7ALPFQTlj.jsFilesize
6KB
MD5f4f7454750c9174d957c0bd04d5cbda2
SHA136eef66588185f56f400d7de370de5b6ff09efca
SHA256d3e2c5d85b58fb4c957aff6e705e4cceac4f0fc15323530106da13ff8efeedf7
SHA512764eb7d2d490ef8782da84270f4884f10f55bea193df3a812770e2d6c0425178b2fb71e8500f588243ea278ea94f16914283be149de1722d72c6c50366c23528
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\ibhlbcnojmeeipfnocmkppehdjoipjan\background.htmlFilesize
147B
MD5babbde5eac5459c9257182ef207fc085
SHA10909f2c62ec720ecacb53b1622769c93d06fc162
SHA256c08cdfb51cc5a60f47e8c0650b16e4133f89437bfc7311d2404b2f43c09f3cd0
SHA512950e287ddbec5039a55de7e0105e55b16c0850188f30797b4679ab1f60efd8dac5535eec707e47f9e3eb0dd8ba0b3e4f5aa79c0f7e0af2b67acece5de7db1e24
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\ibhlbcnojmeeipfnocmkppehdjoipjan\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\ibhlbcnojmeeipfnocmkppehdjoipjan\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSB700.tmp\ibhlbcnojmeeipfnocmkppehdjoipjan\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4792-132-0x0000000000000000-mapping.dmp