c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe
Size

931KB
MD5

3ba47f3a46a97006fc5a29e7557d7f4c
SHA1

316c8cbd0331118ad7355c6501ceb3701c436b40
SHA256

c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3
SHA512

e1fc1e80d3c0459aad4bcc4854021aa35cd561fcca344cf8344a06fb64a54a601fa26681c9d5f9d3a01ceb5520cd9bb8a50d78b031076523d65ec562d42735e3
SSDEEP

24576:h1OYdaOgCZ/iWCvu/2sWsJA/jlt+DHhsN:h1OsOCpYO/dJJDHhsN

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

im6fVyo3moX0s9W.exe

pid process

552 im6fVyo3moX0s9W.exe
Loads dropped DLL 1 IoCs

Processes:

c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe

pid process

812 c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
812	c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe

Drops Chrome extension 3 IoCs

Processes:

im6fVyo3moX0s9W.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmafenapamdjoemcbimpokhleoahckni\2.0\manifest.json	im6fVyo3moX0s9W.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmafenapamdjoemcbimpokhleoahckni\2.0\manifest.json	im6fVyo3moX0s9W.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmafenapamdjoemcbimpokhleoahckni\2.0\manifest.json	im6fVyo3moX0s9W.exe

Drops file in System32 directory 4 IoCs

Processes:

im6fVyo3moX0s9W.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	im6fVyo3moX0s9W.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	im6fVyo3moX0s9W.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	im6fVyo3moX0s9W.exe
File opened for modification	C:\Windows\System32\GroupPolicy	im6fVyo3moX0s9W.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

im6fVyo3moX0s9W.exe

pid	process
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe
552	im6fVyo3moX0s9W.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

im6fVyo3moX0s9W.exe

description	pid	process
Token: SeDebugPrivilege	552	im6fVyo3moX0s9W.exe
Token: SeDebugPrivilege	552	im6fVyo3moX0s9W.exe
Token: SeDebugPrivilege	552	im6fVyo3moX0s9W.exe
Token: SeDebugPrivilege	552	im6fVyo3moX0s9W.exe
Token: SeDebugPrivilege	552	im6fVyo3moX0s9W.exe
Token: SeDebugPrivilege	552	im6fVyo3moX0s9W.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe

description	pid	process	target process
PID 812 wrote to memory of 552	812	c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe	im6fVyo3moX0s9W.exe
PID 812 wrote to memory of 552	812	c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe	im6fVyo3moX0s9W.exe
PID 812 wrote to memory of 552	812	c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe	im6fVyo3moX0s9W.exe
PID 812 wrote to memory of 552	812	c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe	im6fVyo3moX0s9W.exe

C:\Users\Admin\AppData\Local\Temp\c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe
"C:\Users\Admin\AppData\Local\Temp\c3b2f558b632f77283fbae1a56334d200c369479cefcc949586d40fdb3614fb3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\im6fVyo3moX0s9W.exe
.\im6fVyo3moX0s9W.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
026a61610633f632260d317e18f740ca

SHA1
76a7793eb1ad3ab22df0c0ea43c1459222c373bd

SHA256
25ef25dab419d3760373b581411e3ce5fba195a2a302c04e8b0df7c34870d3d7

SHA512
9ee877127755a862e8f72f530f394b25412628bdc6568fc62fccb6b20f6affd1d1e94a5f29561a8c3d60adf5521039b2fa00bf42958c170c65f37ee4675d901a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
96b3695473d80bfc575a51783d48981d

SHA1
939244f30ec696869c5b7114d55d2c73305e743f

SHA256
aa3baca668a331339ce9089b085df0f70e13e61a67c6becdd018ecaa1c4658bb

SHA512
2449f0e47d21061c0a8fa31a39b32185b14f095d10f5056663cdb393273e604045e6c91013538fdf8b4bd359ca4f11ee0984274a72b9ac9764e883589cfb57e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\[email protected]\install.rdf
Filesize
596B

MD5
32e4097e56ae06d709b6f9aeaea2eb52

SHA1
24aed5fde895babb4c704f84bb32cc390e41e8ed

SHA256
7bfb743955670d509568562e9ef8ab48b063c2d825970cb29df75c30aaf230f3

SHA512
d50e116766572c4ebaacfe6f58fb52a38d7d574bbf7d70a1f1962fb3a685328b2dacde4ce2db73ec4f8b6d11e52b8ea03328ccf17fbf87ce6992da52fe0b0e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\im6fVyo3moX0s9W.dat
Filesize
1KB

MD5
1575fd0312dfc2527c4f55da4135f0f4

SHA1
98b8aed3c1978ac635958d5a055025df9cf42bd9

SHA256
72122dae9c5284384991586699d45a116259bf937dc0de8361f52e7403676b4f

SHA512
db44d190645eee12dfa07a738c81f2eb52bee00ea61e7aee583db7c927f8a5cf5ac26870f05934c31367754cc7c16188f789de6a1d1fb9c41ae85cd2b6f95ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\im6fVyo3moX0s9W.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\nmafenapamdjoemcbimpokhleoahckni\Cc3.js
Filesize
6KB

MD5
2aeddcd130fa0e92225892ad1bcd479f

SHA1
11f23e8c64acf4d7c3eec3aab8e5f6f6fdcabe31

SHA256
ad919278143898b5d70bfc81bbc8a9aa21ca955ca3524a3f8f24e077422e85df

SHA512
e71fca6be52bb5dbb540f6022288cdc66a29d301a5472a99a64111fd3f7edc861085de32e5f96de944f08f7eac3636121f1773e72d91c79b805a663dfe971aa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\nmafenapamdjoemcbimpokhleoahckni\background.html
Filesize
140B

MD5
3a61fcfae6020acd28f8323b408385f6

SHA1
d91261329d38309160141414b3af4c22ee3634f9

SHA256
c8987a00fd5c9d4de04185cf798a86f5756a60f672fc1f05413d6b97030f6d76

SHA512
0d9d43ac9933b1909f14946a76cfca4b6ba3ab6bd5bc16e961b3bd933a622256abea4a37ed70eb2d473fab576bef55953d0d95c17c9b9e18050df2a7bceeaa1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\nmafenapamdjoemcbimpokhleoahckni\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\nmafenapamdjoemcbimpokhleoahckni\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\nmafenapamdjoemcbimpokhleoahckni\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF6C.tmp\im6fVyo3moX0s9W.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/552-56-0x0000000000000000-mapping.dmp

Download
memory/812-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads