Analysis

  • max time kernel
    46s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 19:38

General

  • Target

    c37ef81df47227fd262d8247fc5607f6e42890f64669c889902105b2e0766dc6.exe

  • Size

    2.5MB

  • MD5

    5a0e9c31a6a64b678faa865c857b606e

  • SHA1

    8fc86ba5af74a2631b1eef49d964020e5c360762

  • SHA256

    c37ef81df47227fd262d8247fc5607f6e42890f64669c889902105b2e0766dc6

  • SHA512

    83442a673b13beba03cbb5d6811edb739060e54dec5434cc39be968bb4345396b32bc6ab3cee45cd97190164ca1bbc74daef53b7348ff82116a68f1f8c88bf8a

  • SSDEEP

    49152:h1Os/SQeb71DLvFzAqRmyyVchO4apKHcHhXa3FXWlPC1IS5zZ:h1OkSQY1DCqkck4apyLqi

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c37ef81df47227fd262d8247fc5607f6e42890f64669c889902105b2e0766dc6.exe
    "C:\Users\Admin\AppData\Local\Temp\c37ef81df47227fd262d8247fc5607f6e42890f64669c889902105b2e0766dc6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\h8CrtE0tPmD7rpm.exe
      .\h8CrtE0tPmD7rpm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:592
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:948

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.dat
    Filesize

    6KB

    MD5

    0ed2d221ea22915c6d2d6ab6aa7a9f22

    SHA1

    5c0375b5cee8131f1d24ab7403aba93d59bac6ea

    SHA256

    f72e97a80a7495e99d8ec6bbcfc7f965177ea4410c27a2f7d90e867208bb555e

    SHA512

    aec50e651238ff3a09e31433871759158f8f7099d079964c43c1fe84435fbc39a038ff185f85d732e8a5c916f0cd5e28aa4a8fdc724b6b7f355819507e67948c

  • C:\Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.x64.dll
    Filesize

    886KB

    MD5

    1433d7e71196529644716ffc72c261b2

    SHA1

    f35147e7dc56f4e92856061b48c9f7a872e10385

    SHA256

    2ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f

    SHA512

    c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\LcR0qqnVRS027Q.dll
    Filesize

    745KB

    MD5

    ce27e078a917088b7459c44570637b9d

    SHA1

    4d9e95fc9b97a1f21221f96ea8fbee55132e82b7

    SHA256

    8804ae047c9ba998964a359f278f54fa1d671ed245b7dfe117625f1ce0d5e84f

    SHA512

    492fdacef00a45dfe6d9db9c80b908bd0d9ebb4bf75c1f4053a8e281cfad5279646754a711484709de6f571487276ec19f71552522dc218fba8331bf6358f9ce

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\LcR0qqnVRS027Q.tlb
    Filesize

    3KB

    MD5

    f636475c74627ddf7b3b6b6dfaa8d491

    SHA1

    fb3a63977f8b0e07f18d313ace3e1f1223dc423b

    SHA256

    e6e330d72d59551c9ba78464c4081280510901a82f66d94c84cc94ca4594e4b2

    SHA512

    ba788afd76700c60fa8d899ea6ebc1c69594b09d9099c7cb4d408e290575c9ed89b0288df1a1ca9f1562564eb65f51f8add17f4c57eea7fe890b38592560fb96

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\LcR0qqnVRS027Q.x64.dll
    Filesize

    886KB

    MD5

    1433d7e71196529644716ffc72c261b2

    SHA1

    f35147e7dc56f4e92856061b48c9f7a872e10385

    SHA256

    2ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f

    SHA512

    c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\YJ07n@A.net\bootstrap.js
    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\YJ07n@A.net\chrome.manifest
    Filesize

    35B

    MD5

    77877bacfa78e7661de9ee8f9a3f82cf

    SHA1

    63ecb72f5546bb7630bd2a29eb7af43a2ddc70f3

    SHA256

    8cd45f77fcf2e1e24bda6797b4101fbfea4b9db75892e5cbe1d1eddbcde6d5b8

    SHA512

    a45b318c7345a72e40a48161d2d43c61f4ff4c0d41d8a7e5b989cfdd9fbae335354184e0e335db59eaf9677f006b7bda4b9df26667ff660fb83c26c1c94ccbd3

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\YJ07n@A.net\content\bg.js
    Filesize

    7KB

    MD5

    15f0e26c705078bde974e65a9f55c443

    SHA1

    583e6b226b09511e56e3c35321c8ee92e0e641eb

    SHA256

    68cf22b42633e8dd840056176c444e5a97313faf3ce1526d464440610d2a3b2c

    SHA512

    88c28614b793685c9cfb7ad17ad732ed8b3f5c81cee722290e8ed19b4990acd5350dddebc9872ed54010dabb261a702e6d74f8a8e7adba13412312b6e7b02634

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\YJ07n@A.net\install.rdf
    Filesize

    599B

    MD5

    27f469f0c0250a9ccf6236a5a057cf27

    SHA1

    9af15ab9216513686eed5c4f2c07287cbb159f64

    SHA256

    93cbfe86ceec126dc3cc8add2f4cc121634fb652dd185e84df56cb00a095d03c

    SHA512

    b98a23bc679431294fe348d60b1fef2f6e30c262624ddda9354f7b29be62cc152dee55779c3a0523225ccb797162cdbcba165a0b98ccea0d2cc8e0de91191d16

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\beaeiolhbdbfcogcfnmnmcpjagdnibji\U.js
    Filesize

    5KB

    MD5

    273e98658b60998867e6abbe36898cd6

    SHA1

    d73eb96d64de16bf31ce2f796bf6ccf47d701d45

    SHA256

    72fed899300aee252f4369ed74e067848821b170221312139361dc44134907fa

    SHA512

    2d9a163fd99911fd68d5262f74c3ac02af79107c01cb51085f4c89bddf40910bfa1d3721299407405552efbbe0937b366c93a342ff6d2b2a60016b5db009ffcf

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\beaeiolhbdbfcogcfnmnmcpjagdnibji\background.html
    Filesize

    138B

    MD5

    e1b4deb0e527b3cf57477d89855bea06

    SHA1

    d815c8fb55038db446043b8590737a40a7f3d809

    SHA256

    4250433b6b4d17673c63d7b850d0eb440fe4a6ad00baa41ca0fd1481e92d0a23

    SHA512

    bb06bd5b56ada66f1f93ae154e4375762cf878acafd327bea99e41d492ccedd1a7b79262bac54bbcc52494d1625de7fd74babeb495f2b74252e3831f4e1b7c90

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\beaeiolhbdbfcogcfnmnmcpjagdnibji\content.js
    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\beaeiolhbdbfcogcfnmnmcpjagdnibji\lsdb.js
    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\beaeiolhbdbfcogcfnmnmcpjagdnibji\manifest.json
    Filesize

    504B

    MD5

    d532994175ac6e4e8fea2ae07edef6ff

    SHA1

    5646eab3cebc8b0a804103b63f08a63db784a77d

    SHA256

    f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d

    SHA512

    ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\h8CrtE0tPmD7rpm.dat
    Filesize

    6KB

    MD5

    0ed2d221ea22915c6d2d6ab6aa7a9f22

    SHA1

    5c0375b5cee8131f1d24ab7403aba93d59bac6ea

    SHA256

    f72e97a80a7495e99d8ec6bbcfc7f965177ea4410c27a2f7d90e867208bb555e

    SHA512

    aec50e651238ff3a09e31433871759158f8f7099d079964c43c1fe84435fbc39a038ff185f85d732e8a5c916f0cd5e28aa4a8fdc724b6b7f355819507e67948c

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\h8CrtE0tPmD7rpm.exe
    Filesize

    770KB

    MD5

    b4c30381dd37fea1c1c69bcb3ad48b32

    SHA1

    869eca61396754586f7e85ebf65a334e01856740

    SHA256

    66481ba6d9cbf3c7662fc7cfd867739077256f60f4165f76dfdcd9461500ae50

    SHA512

    1e7bbdd7a75b748ff9a5f70b46766b0108effc84e0cc7c5d8a1f32e56136181060a4363ed2cbd6ed14d195a2379cf8148680380256f31b809bb77d1fe0bf064f

  • C:\Users\Admin\AppData\Local\Temp\7zS3026.tmp\h8CrtE0tPmD7rpm.exe
    Filesize

    770KB

    MD5

    b4c30381dd37fea1c1c69bcb3ad48b32

    SHA1

    869eca61396754586f7e85ebf65a334e01856740

    SHA256

    66481ba6d9cbf3c7662fc7cfd867739077256f60f4165f76dfdcd9461500ae50

    SHA512

    1e7bbdd7a75b748ff9a5f70b46766b0108effc84e0cc7c5d8a1f32e56136181060a4363ed2cbd6ed14d195a2379cf8148680380256f31b809bb77d1fe0bf064f

  • \Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.dll
    Filesize

    745KB

    MD5

    ce27e078a917088b7459c44570637b9d

    SHA1

    4d9e95fc9b97a1f21221f96ea8fbee55132e82b7

    SHA256

    8804ae047c9ba998964a359f278f54fa1d671ed245b7dfe117625f1ce0d5e84f

    SHA512

    492fdacef00a45dfe6d9db9c80b908bd0d9ebb4bf75c1f4053a8e281cfad5279646754a711484709de6f571487276ec19f71552522dc218fba8331bf6358f9ce

  • \Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.x64.dll
    Filesize

    886KB

    MD5

    1433d7e71196529644716ffc72c261b2

    SHA1

    f35147e7dc56f4e92856061b48c9f7a872e10385

    SHA256

    2ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f

    SHA512

    c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c

  • \Program Files (x86)\Browser Shop\LcR0qqnVRS027Q.x64.dll
    Filesize

    886KB

    MD5

    1433d7e71196529644716ffc72c261b2

    SHA1

    f35147e7dc56f4e92856061b48c9f7a872e10385

    SHA256

    2ae79c724f8c2a134c125315fc6ee929b7ce09260e80b61c9a9e915571103e3f

    SHA512

    c363a35bd82214350439dcf6aaf9048b29f10aaeb3b1c3a69222792a94fab1009a5f6b6528df102ae082c129cce50ae7d646abc1dbd8ff9e788a9d05828c272c

  • \Users\Admin\AppData\Local\Temp\7zS3026.tmp\h8CrtE0tPmD7rpm.exe
    Filesize

    770KB

    MD5

    b4c30381dd37fea1c1c69bcb3ad48b32

    SHA1

    869eca61396754586f7e85ebf65a334e01856740

    SHA256

    66481ba6d9cbf3c7662fc7cfd867739077256f60f4165f76dfdcd9461500ae50

    SHA512

    1e7bbdd7a75b748ff9a5f70b46766b0108effc84e0cc7c5d8a1f32e56136181060a4363ed2cbd6ed14d195a2379cf8148680380256f31b809bb77d1fe0bf064f

  • memory/592-73-0x0000000000000000-mapping.dmp
  • memory/948-78-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmp
    Filesize

    8KB

  • memory/948-77-0x0000000000000000-mapping.dmp
  • memory/1564-54-0x0000000075681000-0x0000000075683000-memory.dmp
    Filesize

    8KB

  • memory/1748-56-0x0000000000000000-mapping.dmp