c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e

Analysis

max time kernel
156s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe
Size

919KB
MD5

0101c8a594210658d41570baf6459cbb
SHA1

80e1d00bea6d6fc310d93eb4edaa7cafd6b467fc
SHA256

c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e
SHA512

dfdd5d947350321ec5514952b8958f6b05ec70b394646d2ebf9adb2069aced9b3c09f3c2cc952f21b7412ca7e29f88ae506f35028b3b634fd58a7f2f90ce4c09
SSDEEP

24576:h1OYdaOOMtdHAqcdDVhYwiei7+EpFAh/kKl:h1OsPPHVmVhYwiLtKkKl

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

6Qq2OGamqv0MFhg.exe

pid process

4020 6Qq2OGamqv0MFhg.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

6Qq2OGamqv0MFhg.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\melkbmcmoffckjmohocgdbinimaehemf\2.0\manifest.json	6Qq2OGamqv0MFhg.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\melkbmcmoffckjmohocgdbinimaehemf\2.0\manifest.json	6Qq2OGamqv0MFhg.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\melkbmcmoffckjmohocgdbinimaehemf\2.0\manifest.json	6Qq2OGamqv0MFhg.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\melkbmcmoffckjmohocgdbinimaehemf\2.0\manifest.json	6Qq2OGamqv0MFhg.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\melkbmcmoffckjmohocgdbinimaehemf\2.0\manifest.json	6Qq2OGamqv0MFhg.exe

Drops file in System32 directory 4 IoCs

Processes:

6Qq2OGamqv0MFhg.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	6Qq2OGamqv0MFhg.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	6Qq2OGamqv0MFhg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	6Qq2OGamqv0MFhg.exe
File opened for modification	C:\Windows\System32\GroupPolicy	6Qq2OGamqv0MFhg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

6Qq2OGamqv0MFhg.exe

pid	process
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe
4020	6Qq2OGamqv0MFhg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

6Qq2OGamqv0MFhg.exe

description	pid	process
Token: SeDebugPrivilege	4020	6Qq2OGamqv0MFhg.exe
Token: SeDebugPrivilege	4020	6Qq2OGamqv0MFhg.exe
Token: SeDebugPrivilege	4020	6Qq2OGamqv0MFhg.exe
Token: SeDebugPrivilege	4020	6Qq2OGamqv0MFhg.exe
Token: SeDebugPrivilege	4020	6Qq2OGamqv0MFhg.exe
Token: SeDebugPrivilege	4020	6Qq2OGamqv0MFhg.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe

description	pid	process	target process
PID 3136 wrote to memory of 4020	3136	c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe	6Qq2OGamqv0MFhg.exe
PID 3136 wrote to memory of 4020	3136	c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe	6Qq2OGamqv0MFhg.exe
PID 3136 wrote to memory of 4020	3136	c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe	6Qq2OGamqv0MFhg.exe

C:\Users\Admin\AppData\Local\Temp\c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe
"C:\Users\Admin\AppData\Local\Temp\c3e79273c363d1ba6a59a36c9272c351e2e0828254b73800704804818316de3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\6Qq2OGamqv0MFhg.exe
.\6Qq2OGamqv0MFhg.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\6Qq2OGamqv0MFhg.dat
Filesize
1KB

MD5
3275d1337b2b1d8008776018acaa5573

SHA1
154f7cdc6663ef72768cec30756beb2c9a40e2de

SHA256
5279488892fdcc56d65ff2f4f161225e684b167518c8de6eace01983f1178aae

SHA512
d087b0bdc83027b24be418834ab8f4eb87e219a785ef641e3a6ef9738e11e159f573ba15ab2ec31b17da14816a35a71044a54c3e6cf844951b6193d0b9aebed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\6Qq2OGamqv0MFhg.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\6Qq2OGamqv0MFhg.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
b6dccbeedec0f79e794895b99cc28ae8

SHA1
b21bbecf6248b9a620f49c0280765c65ecba5f6a

SHA256
9d9b5b491489af0cfc90f8ff0df91aac04440df1762134c8bd837d606967cf68

SHA512
9fafb6cceeb74756dbf471b9785c76e493479925739a3ea6eec3bdd2f0d603a67767e460d0a82a81db922433f771a42c7d9b563459c45f8ba70fead719922d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
7daa2d2d7a2bd2294f3c2f62c2bd2d63

SHA1
5df460be26f37e2c9917ad6c6a52bb2915858d70

SHA256
ce2efe5e02e11cbb715a5f1cad2fa1b63c82764e2d583b25d44e87a580967faf

SHA512
c0ff0641f0f23f50c4a0f3e9d02d47c9a65d540ea8cdeb52ab2fa55aab6263f4c42a1b8ee5a4adf54873e31f2b84d9573aa607a9681900a3e27b9f8a50427ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\[email protected]\install.rdf
Filesize
590B

MD5
0177a074e051d2f0cf7a4acbd2ead268

SHA1
a33c7cc40a31532dc88981dc3341cd2bd7af3bb8

SHA256
2436c4124f8611b903d1719d800e0608ab64bac74966317e5c391c9630186027

SHA512
05ed30483d1cd9f08f58be19cc2cee2e371ebe0b5277bc31563b12364c7f6f76df0b2a9337ce3346a9969ce8b48f9b8b2a987b5f11572e9bddc91d4b997f3d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\melkbmcmoffckjmohocgdbinimaehemf\BGQdlrDQ.js
Filesize
6KB

MD5
f9deb5bb7f2408fe1fb4359fcde34684

SHA1
9df84c7bd78b65df13d9b17305ff4930bcc33e82

SHA256
843b55ca4f47cf1ba4542c54e8639f525ac2da857619c76874851b8accc48df9

SHA512
36def7ed408c81cb83e554eecad1903ce2f6e5f6f1feacf375a86140c43d2be14d1e6938b562424f10265b0d32593717dcec91b8cee7e1382c0f0067e127244b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\melkbmcmoffckjmohocgdbinimaehemf\background.html
Filesize
145B

MD5
8938fd99988ec0566b9764e652c67d38

SHA1
77c43a7e1e7c3f089abd8eee77b890ab566e4704

SHA256
74b7847a57749a3d19f0297637a42651843f0a34dcd92ebdbda4c0aa8b752eff

SHA512
e484215b368fb46ab22b1bc077b99e418647e871260cc2567c1583b3dad00f62963bf26a9c7266b25b970d16fc5da9f3d1f3dd7c662a84f91f1b4403e0b04cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\melkbmcmoffckjmohocgdbinimaehemf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\melkbmcmoffckjmohocgdbinimaehemf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF7C.tmp\melkbmcmoffckjmohocgdbinimaehemf\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4020-132-0x0000000000000000-mapping.dmp

Download