Analysis
-
max time kernel
124s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:41
Static task
static1
Behavioral task
behavioral1
Sample
c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe
Resource
win7-20220812-en
General
-
Target
c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe
-
Size
931KB
-
MD5
d97fce461dcce19c1f42d0ca3e7403f8
-
SHA1
fa6e4da1f62e73743a999dda38cbf07291bd23e6
-
SHA256
c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d
-
SHA512
4917809cd74ad691ed20b7833385b0119f3d0ec64f95679b64d4091892a54f114c0f268d75ee590fa182610f65e63aff19cb3ca51eedeb81c0edd7b11f0ab53a
-
SSDEEP
24576:h1OYdaOXCZ/iWCvu/2sWsJA/jlt+DHhsv:h1Os5CpYO/dJJDHhsv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
QH2lsUPnJix6CNI.exepid process 2328 QH2lsUPnJix6CNI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
QH2lsUPnJix6CNI.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bihganklolicaghhnpeobefgidibcgie\2.0\manifest.json QH2lsUPnJix6CNI.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bihganklolicaghhnpeobefgidibcgie\2.0\manifest.json QH2lsUPnJix6CNI.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bihganklolicaghhnpeobefgidibcgie\2.0\manifest.json QH2lsUPnJix6CNI.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bihganklolicaghhnpeobefgidibcgie\2.0\manifest.json QH2lsUPnJix6CNI.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bihganklolicaghhnpeobefgidibcgie\2.0\manifest.json QH2lsUPnJix6CNI.exe -
Drops file in System32 directory 4 IoCs
Processes:
QH2lsUPnJix6CNI.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini QH2lsUPnJix6CNI.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol QH2lsUPnJix6CNI.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI QH2lsUPnJix6CNI.exe File opened for modification C:\Windows\System32\GroupPolicy QH2lsUPnJix6CNI.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
QH2lsUPnJix6CNI.exepid process 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe 2328 QH2lsUPnJix6CNI.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
QH2lsUPnJix6CNI.exedescription pid process Token: SeDebugPrivilege 2328 QH2lsUPnJix6CNI.exe Token: SeDebugPrivilege 2328 QH2lsUPnJix6CNI.exe Token: SeDebugPrivilege 2328 QH2lsUPnJix6CNI.exe Token: SeDebugPrivilege 2328 QH2lsUPnJix6CNI.exe Token: SeDebugPrivilege 2328 QH2lsUPnJix6CNI.exe Token: SeDebugPrivilege 2328 QH2lsUPnJix6CNI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exedescription pid process target process PID 2296 wrote to memory of 2328 2296 c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe QH2lsUPnJix6CNI.exe PID 2296 wrote to memory of 2328 2296 c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe QH2lsUPnJix6CNI.exe PID 2296 wrote to memory of 2328 2296 c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe QH2lsUPnJix6CNI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe"C:\Users\Admin\AppData\Local\Temp\c2eeb3a968fcd5220a4a32e1e7a82bc1c57e7f8387bb768d33c5660becff047d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\QH2lsUPnJix6CNI.exe.\QH2lsUPnJix6CNI.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\QH2lsUPnJix6CNI.datFilesize
1KB
MD59c346b1f6f00b228ec5de3aeec49f83b
SHA1784c398cfa427fbfc45d44e3056013328d3d4cf8
SHA256db0a162071525586e9c70ec48f39e2a69e3d950218407fbf58f1ab8b561f179e
SHA5124250cdf22885db6949c96131ad23ab105ee65eb87044a7c0bf610b18eb64716275f59c375f03f97f4700bfc777b0ba01a7016e5804bc933fb5bc8d117a536b8e
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\QH2lsUPnJix6CNI.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\QH2lsUPnJix6CNI.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\bihganklolicaghhnpeobefgidibcgie\background.htmlFilesize
144B
MD52397ee720e8b724559e944ed03b6d3b1
SHA12d30551a4b88368c6c5488acab3846d050c54a6a
SHA256962d242f99592c40686f4490d7d17eeec7ece86397fa6d635b3a9ac5f0c53346
SHA512f3801010516fdef7a47f76146d8fd60dffe0e870b5e7f705552c154f7185f5bc78779a0c0407990aab01434b917cbbd30b8373deaa1ff873599b2484a8ca2ba9
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\bihganklolicaghhnpeobefgidibcgie\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\bihganklolicaghhnpeobefgidibcgie\damAzPL.jsFilesize
6KB
MD5e278b3e3ec803f4843adfaaef7255531
SHA12c9ad632e4b8117d1b7d0696968ba2e8e210bca2
SHA256a6c6ef840f01fc684b38ae0cc7eaeb00740edee19fa471e2e96ed4df34503624
SHA51269f30a2103a07f664020d6d7858da76d1fc440fb06af619d242ec52f9276a159dcb88be170a7333f426e2e2a7eeee12e0102e5b9716ca8815d38de2c442df8ec
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\bihganklolicaghhnpeobefgidibcgie\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\bihganklolicaghhnpeobefgidibcgie\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\q@Hf.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\q@Hf.org\chrome.manifestFilesize
35B
MD57d614173d907b5f5ded76aa04eef60e1
SHA15cdb8a67bbd3372016deca5a3cd4f5ed43346516
SHA2566799359fb817f8474070f2a4eb01c8dd4c26440e88ad243c25291d95a3b6920b
SHA51287767db86094f4e68a7ab4fec9276c282b8f987590a7b6a2a0c2253e247d5deafe3a74f723384b5bb535e382897d14949c0c26e81a417188503362971f00ee0a
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\q@Hf.org\content\bg.jsFilesize
8KB
MD5b827edc90af4bd5af4adaec677541e5c
SHA192e26ae0fe1f67f78f98afc935b80c195faf5184
SHA256a2ac25113c838df00df727f2f62eaa4ad479b9ff10d1cd22d6f8554ef47e77c4
SHA5128441681192352e108cd4800ce09ad0fba1406db627400995e04b90df3b6f770bb54a87f65a6a7220d32689d9a708435b007fdea89de27ae85f730d1b91da4cf9
-
C:\Users\Admin\AppData\Local\Temp\7zSB6D1.tmp\q@Hf.org\install.rdfFilesize
590B
MD548605cf3cd8d00eb7678133138e5f0d9
SHA1e611d47ec4d9daae1a2939ab9f77b7ce4ebe5957
SHA256ecdc9f63b2b6ef44553c269bb3ba6c3cbbe81fdcc6438eb545f08f5476bb1bca
SHA512a7d680109cb3121697ae485d87221539dd7d4173bebd2c0121832305c77726e421fd353e8fbf57e7979141a6aea1b1c21a9677c4f7948a1e646ef9a3374f1062
-
memory/2328-132-0x0000000000000000-mapping.dmp