c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0

General

Target

c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe
Size

2.5MB
MD5

36b4028859ecb8923fe498c55b1a9180
SHA1

bf331496d8b4a2896e832667e4ce91fda70a3123
SHA256

c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0
SHA512

0a0c1589127a0ecc916e633a437d0fa4a3c7a289eb546774852d5a198b535d7f58322289a07ad402c6706c85991386b3be0864409a0f8e2f975c81853dd2f4e4
SSDEEP

49152:h1OsOAQ+1ho2H8swSCCwwFB9nfFVDRBTY/3X5wRLCr56JK8x+:h1OMQzVCwJ/3CRLCrY8J

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ljH6L6ifzBOG2eh.exe

pid process

1108 ljH6L6ifzBOG2eh.exe
Loads dropped DLL 1 IoCs

Processes:

c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe

pid process

1644 c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1108	ljH6L6ifzBOG2eh.exe

pid	process
1644	c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe

Drops Chrome extension 3 IoCs

Processes:

ljH6L6ifzBOG2eh.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpmclamomhnekjmfdonbbednjbfldmfl\2.0\manifest.json	ljH6L6ifzBOG2eh.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpmclamomhnekjmfdonbbednjbfldmfl\2.0\manifest.json	ljH6L6ifzBOG2eh.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpmclamomhnekjmfdonbbednjbfldmfl\2.0\manifest.json	ljH6L6ifzBOG2eh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ljH6L6ifzBOG2eh.exe

pid process

1108 ljH6L6ifzBOG2eh.exe

pid	process
1108	ljH6L6ifzBOG2eh.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe

description	pid	process	target process
PID 1644 wrote to memory of 1108	1644	c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe	ljH6L6ifzBOG2eh.exe
PID 1644 wrote to memory of 1108	1644	c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe	ljH6L6ifzBOG2eh.exe
PID 1644 wrote to memory of 1108	1644	c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe	ljH6L6ifzBOG2eh.exe
PID 1644 wrote to memory of 1108	1644	c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe	ljH6L6ifzBOG2eh.exe

C:\Users\Admin\AppData\Local\Temp\c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe
"C:\Users\Admin\AppData\Local\Temp\c30524b5b36c5df5f174d33ec8a8f1f9359f1488c1afd96258a853b60555b6c0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\ljH6L6ifzBOG2eh.exe
.\ljH6L6ifzBOG2eh.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
PID:1108

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\ljH6L6ifzBOG2eh.dat
Filesize
6KB

MD5
b365ba5aee5e4e89f8a6239127dbc67e

SHA1
6886968e7d4230bc8ff525ac2eb5e6815d089c63

SHA256
40ef531afcd4d780ddc500344cb4af51bc5a6d6b6039a8ce20235c0b478347b9

SHA512
836724acba485dc3b880f2debaccc32fb4539ee0360c86da5c774add13ad274fb58d706cbfc2729f20e90d66960de235c9f0641f5e28dc7c74555fd301a78c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\ljH6L6ifzBOG2eh.exe
Filesize
778KB

MD5
2b3591a7eecb2bfda4a75c5f22f52bbb

SHA1
4b57dc7c82dfb5aee529091314787978b6f2e58d

SHA256
def761f4af36128afc624d20df658e2ac6180c3cb72d77c219c95395d57e1aff

SHA512
0bb7cdfb987b6fbeed51cd186292d119f34fb785a31c2ebe58615f7d71e350aa4b55b458cfc9433db7957b5ade46053e3fcfa7ec004b8b6e52e02857d05d6ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\lpmclamomhnekjmfdonbbednjbfldmfl\background.html
Filesize
138B

MD5
7a912a60f22ea7551c8963bfca69c34e

SHA1
b442b0fee4040c584faf43f12fb785f0c604779e

SHA256
04070a18d838fd9651aaaaa2ce216d2b9feb53b24de8a4d3aaf874b3654a8c4c

SHA512
162e96381f3c06be4b765d9475decbfc3037efcfffb115a11665e4a656bc9bc6ef9c574817c5fd358d3720d6dff28796447500be042157e982f73bb2d9d85a07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\lpmclamomhnekjmfdonbbednjbfldmfl\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\lpmclamomhnekjmfdonbbednjbfldmfl\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\lpmclamomhnekjmfdonbbednjbfldmfl\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2379.tmp\lpmclamomhnekjmfdonbbednjbfldmfl\p.js
Filesize
5KB

MD5
d1cd3e19a2d06e03da7422dd7e54115e

SHA1
83bdf65934889e7c3114730ac39c747fe70f5d1d

SHA256
b50911c7f1d7ea032f622caabfafd03d100b0466a08448359bd22487c12cfa8c

SHA512
5c22bd7fa45207e90f709335430e4ffc63e924cd5adaeed76c9fe9bb990535bc3ea4977f7635fa79d622029e95cc4305ad69050dc83b33babd79d12d17ff3036

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2379.tmp\ljH6L6ifzBOG2eh.exe
Filesize
778KB

MD5
2b3591a7eecb2bfda4a75c5f22f52bbb

SHA1
4b57dc7c82dfb5aee529091314787978b6f2e58d

SHA256
def761f4af36128afc624d20df658e2ac6180c3cb72d77c219c95395d57e1aff

SHA512
0bb7cdfb987b6fbeed51cd186292d119f34fb785a31c2ebe58615f7d71e350aa4b55b458cfc9433db7957b5ade46053e3fcfa7ec004b8b6e52e02857d05d6ac9

Download Submit
memory/1108-56-0x0000000000000000-mapping.dmp

Download
memory/1644-54-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing