Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:41
Static task
static1
Behavioral task
behavioral1
Sample
c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe
Resource
win7-20220901-en
General
-
Target
c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe
-
Size
919KB
-
MD5
0c7561c16e0b4cac52cda41d92562f8a
-
SHA1
da7e215a5d6c6ae05ffdc04fc9bf4e802d236424
-
SHA256
c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8
-
SHA512
a2093a6ec59675a9209436e4f1b221cc6ce950650794f2a8256e52b09831e45a85c5f89a8784d3e5588f09a3c83a08e656159f792a39c3768d88455b7e0b53f7
-
SSDEEP
24576:h1OYdaOBMtdHAqcdDVhYwiei7+EpFAh/kKP:h1OsYPHVmVhYwiLtKkKP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
UmQG42uzLirt4LQ.exepid process 1188 UmQG42uzLirt4LQ.exe -
Loads dropped DLL 1 IoCs
Processes:
c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exepid process 1416 c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
UmQG42uzLirt4LQ.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmcidmkjmjmdjkhbcicoajkbahcajkbb\2.0\manifest.json UmQG42uzLirt4LQ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmcidmkjmjmdjkhbcicoajkbahcajkbb\2.0\manifest.json UmQG42uzLirt4LQ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmcidmkjmjmdjkhbcicoajkbahcajkbb\2.0\manifest.json UmQG42uzLirt4LQ.exe -
Drops file in System32 directory 4 IoCs
Processes:
UmQG42uzLirt4LQ.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini UmQG42uzLirt4LQ.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol UmQG42uzLirt4LQ.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI UmQG42uzLirt4LQ.exe File opened for modification C:\Windows\System32\GroupPolicy UmQG42uzLirt4LQ.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
UmQG42uzLirt4LQ.exepid process 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe 1188 UmQG42uzLirt4LQ.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
UmQG42uzLirt4LQ.exedescription pid process Token: SeDebugPrivilege 1188 UmQG42uzLirt4LQ.exe Token: SeDebugPrivilege 1188 UmQG42uzLirt4LQ.exe Token: SeDebugPrivilege 1188 UmQG42uzLirt4LQ.exe Token: SeDebugPrivilege 1188 UmQG42uzLirt4LQ.exe Token: SeDebugPrivilege 1188 UmQG42uzLirt4LQ.exe Token: SeDebugPrivilege 1188 UmQG42uzLirt4LQ.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exedescription pid process target process PID 1416 wrote to memory of 1188 1416 c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe UmQG42uzLirt4LQ.exe PID 1416 wrote to memory of 1188 1416 c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe UmQG42uzLirt4LQ.exe PID 1416 wrote to memory of 1188 1416 c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe UmQG42uzLirt4LQ.exe PID 1416 wrote to memory of 1188 1416 c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe UmQG42uzLirt4LQ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe"C:\Users\Admin\AppData\Local\Temp\c2d60774697d5595efd5884cd43688650980265cf57b3422f7414360d8d01db8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\UmQG42uzLirt4LQ.exe.\UmQG42uzLirt4LQ.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\6G@GvdZ4oM.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\6G@GvdZ4oM.org\chrome.manifestFilesize
35B
MD5480ca94a9ebb2862aa20e85a66635b4d
SHA17c1d95de911304ca7d28b0daa16b1bde7e38b72e
SHA2569a2044715954c2fdb0a6e8a82f5da28e500c963250255426cd44b73bdad9d24a
SHA512a48c64037b8f141000497eb8c239afab2dcfe785c3bb88a86fce6a786ba8d8c393df467ad6403024994da66ec8b6bc30f653306c0a2292d8e4328e799853fb6f
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\6G@GvdZ4oM.org\content\bg.jsFilesize
8KB
MD537affd10d12753266792349ee021fc43
SHA16e2da880418977ec2c75049287060df18a7609e3
SHA25613f050827b88477bf95c7b13cf8a9102009c8ceba99f6f4236f0611b68305a1f
SHA512b39977811b1fcb02df70f46fadf7fb62ad2eb3cf84f3cb581d4439437e51e2802f841fd8267c69036c9cd1692276c792f37d9d778ab4185dbd4a8b9d0f9bdd13
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\6G@GvdZ4oM.org\install.rdfFilesize
596B
MD54389acf6378abb976f1e5888fa3d4bae
SHA128a081b6994ec55be9e4c345ca6fd2b3c2933297
SHA2560153e69c29ef2794bb2b5b4b17d4ff1b7c0976ef341b6b368e02d803c7274833
SHA512d3f1af4b94f0742f3e2df5ff5b6da0f6101ee08af51bea4b0702c19678e060258cfd992bb014185a9ff8999c1d8a501836efd68828b320226bd01d374d1d5e24
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\UmQG42uzLirt4LQ.datFilesize
1KB
MD5d027c28e226d8442d65a59e8c6ae8966
SHA1a9dd2bf924bbd0cfec540122147d6d6f00eb59b8
SHA256e4b216c3de7c2812b1b69511fd188651633311910187ab2bfd84cc68b9465747
SHA5126b49d0bdf36313443c955444140fda850fc3b35176e16e41b8be9ed8ed9df610c18a0ddd921ff5ac374d2fb5dbbfa14620d5a210037ea2582faf5dfa9ac015d8
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\UmQG42uzLirt4LQ.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\bmcidmkjmjmdjkhbcicoajkbahcajkbb\On.jsFilesize
6KB
MD554571271b28932ad2fcc741565d5cf46
SHA14b44c57d89a5222a501b58e99e5aec3079eed234
SHA256ee7f696901c946eaab18fb4c562c1d1e02e0f7e31af1815ad969ed9be8654df4
SHA512ffedeb8d7bf2459e4b472650b4e67515dca69b66e7ae4ec943ce8409a35c2a295882ebc15a7d472b8960b30a46c499a58d30982f248ee61fa3c6e70ee0e9c873
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\bmcidmkjmjmdjkhbcicoajkbahcajkbb\background.htmlFilesize
139B
MD51a9bb82cc0a6f3d8086a12bf9161867f
SHA17934f416806cbd9100f9e764ed90a796f442f0a4
SHA25626601ce25f9cf1323b53b41573e55b5deb54b02e262f9f475b6a03799fd2efaa
SHA512c6dd233e5f9054d33fb4a15415ff5bbbc141b29d301cc4493703a8316f37ae79680acb213678ed30e012f2b0e917be8ee9f057d751bf24d87559169a9fb16406
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\bmcidmkjmjmdjkhbcicoajkbahcajkbb\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\bmcidmkjmjmdjkhbcicoajkbahcajkbb\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\bmcidmkjmjmdjkhbcicoajkbahcajkbb\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zS4A3.tmp\UmQG42uzLirt4LQ.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1188-56-0x0000000000000000-mapping.dmp
-
memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB