Analysis
-
max time kernel
282s -
max time network
286s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:38
Static task
static1
Behavioral task
behavioral1
Sample
c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe
Resource
win7-20220812-en
General
-
Target
c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe
-
Size
927KB
-
MD5
b74b2539835a9356b145073978fc3bfe
-
SHA1
b323e3ef3205fccfbbbdea290602968f6db9a61e
-
SHA256
c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1
-
SHA512
9853494ade0183e0c2277d95d8a3d33d2b472cbeb7fba16d36566d92a6dc3698441330bdce606d33ed8cc04fa0315c4608258034f7004d41e00ff6fa859db246
-
SSDEEP
24576:h1OYdaOM6B06BenQju5vMu6qN2FctIOBYXZBai3GBlgpKLe/7r7:h1Os4QjO6HHzayGBe/7r7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
7Dqh4aE2sMTUdji.exepid process 1272 7Dqh4aE2sMTUdji.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 5 IoCs
Processes:
7Dqh4aE2sMTUdji.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiddgkomgfaedgcjjoodkhloenmfilcn\2.0\manifest.json 7Dqh4aE2sMTUdji.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiddgkomgfaedgcjjoodkhloenmfilcn\2.0\manifest.json 7Dqh4aE2sMTUdji.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiddgkomgfaedgcjjoodkhloenmfilcn\2.0\manifest.json 7Dqh4aE2sMTUdji.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiddgkomgfaedgcjjoodkhloenmfilcn\2.0\manifest.json 7Dqh4aE2sMTUdji.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiddgkomgfaedgcjjoodkhloenmfilcn\2.0\manifest.json 7Dqh4aE2sMTUdji.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
7Dqh4aE2sMTUdji.exepid process 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe 1272 7Dqh4aE2sMTUdji.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7Dqh4aE2sMTUdji.exedescription pid process Token: SeDebugPrivilege 1272 7Dqh4aE2sMTUdji.exe Token: SeDebugPrivilege 1272 7Dqh4aE2sMTUdji.exe Token: SeDebugPrivilege 1272 7Dqh4aE2sMTUdji.exe Token: SeDebugPrivilege 1272 7Dqh4aE2sMTUdji.exe Token: SeDebugPrivilege 1272 7Dqh4aE2sMTUdji.exe Token: SeDebugPrivilege 1272 7Dqh4aE2sMTUdji.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exedescription pid process target process PID 3600 wrote to memory of 1272 3600 c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe 7Dqh4aE2sMTUdji.exe PID 3600 wrote to memory of 1272 3600 c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe 7Dqh4aE2sMTUdji.exe PID 3600 wrote to memory of 1272 3600 c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe 7Dqh4aE2sMTUdji.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe"C:\Users\Admin\AppData\Local\Temp\c3ae51b1a05c7f1ebce766413958cff7740748d9c6d1e042b8f67db9232ae8f1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\7Dqh4aE2sMTUdji.exe.\7Dqh4aE2sMTUdji.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\7Dqh4aE2sMTUdji.datFilesize
1KB
MD5254be284d19ab8e0770a745d0ea00642
SHA1a0ea59270a76e5b2f307695a3963060222b10ad2
SHA256ca1592ef6980dcfb54e12447e255c2c5343a72aac8c367b30efeb64ba1caed31
SHA51217bde839ed8f8a39eea3985144174064029c0f8e18de32a66a7e60ac1083f1f2b1623edc31f952e4a0f6acee5f7e9a4364729dfcba9239d42440c14a20ae430d
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\7Dqh4aE2sMTUdji.exeFilesize
768KB
MD509e156c94b649920c0c6efa8508ada9a
SHA18ba966f84a07648613468b06a11d17f2650e8af0
SHA2562584e4b5077edba37c8e6f97ccdc2e582136ae0144212b37eb97cd4d8685059a
SHA5121a1d2ff05d413ec1c18735dcb06775f0e652fc778f0ce31a9bdc8e567beb32253df635ee2e9b3bdc430c49f0f5ca6128e44cbd88b2cb712a6712c8327f209375
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\7Dqh4aE2sMTUdji.exeFilesize
768KB
MD509e156c94b649920c0c6efa8508ada9a
SHA18ba966f84a07648613468b06a11d17f2650e8af0
SHA2562584e4b5077edba37c8e6f97ccdc2e582136ae0144212b37eb97cd4d8685059a
SHA5121a1d2ff05d413ec1c18735dcb06775f0e652fc778f0ce31a9bdc8e567beb32253df635ee2e9b3bdc430c49f0f5ca6128e44cbd88b2cb712a6712c8327f209375
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\iiddgkomgfaedgcjjoodkhloenmfilcn\TG.jsFilesize
6KB
MD50784edb61f386734ff71125f17a9955a
SHA1089dbe550be1b2b5f258416428e35e08f5f35c66
SHA256d48751a62b4e75c6f228bc92102a6d1c40e00deedd5634e144a29cc4a9ac7f91
SHA5121ae595307500fb5b6557bf5e249150a907631d4ba8e93b81570b586515ac1779cc9c9959f8c1ee36e754a79f9b549948b39276e11554a6586f9f6f9ae8b42054
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\iiddgkomgfaedgcjjoodkhloenmfilcn\background.htmlFilesize
139B
MD55d59f4ed2b589d29d5f6fc678150c585
SHA17906e351a09d641ebaf2caf4bd3d4aa2d3f5f4e2
SHA2562063ea73c2925924e5972704a0922e6bf4db503e4edaa280b1027547ab621fe9
SHA512030f44713d40fb063201637168a5cbd0ba391a6ae761acefda809d94fcb03c9ed791a465afc6d3abd19e859ffcaa0ff9e1092bd538a725c285a494aa3e56d6ca
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\iiddgkomgfaedgcjjoodkhloenmfilcn\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\iiddgkomgfaedgcjjoodkhloenmfilcn\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSB939.tmp\iiddgkomgfaedgcjjoodkhloenmfilcn\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/1272-132-0x0000000000000000-mapping.dmp