Analysis

  • max time kernel
    35s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 19:39

General

  • Target

    c360eebebb199e45488ce9da95791d0ae4d2ff1bad740cb199ab8e20ce659a37.exe

  • Size

    920KB

  • MD5

    a76dd7bf9b71a08647796991a0429812

  • SHA1

    29c46f0a1d8ad489de5ffca2cd7b8b4d1c521222

  • SHA256

    c360eebebb199e45488ce9da95791d0ae4d2ff1bad740cb199ab8e20ce659a37

  • SHA512

    eb44ef8b8e076b6ba3ca059b3b998d08e98fd25e4065a3ccc333b06546071a2d258b3977c9254a72f069c046ebe161f7723e1bfd874e2358c9b156c5d6ef60cf

  • SSDEEP

    24576:h1OYdaO+MtdHAqcdDVhYwiei7+EpFAh/kKt:h1Os3PHVmVhYwiLtKkKt

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c360eebebb199e45488ce9da95791d0ae4d2ff1bad740cb199ab8e20ce659a37.exe
    "C:\Users\Admin\AppData\Local\Temp\c360eebebb199e45488ce9da95791d0ae4d2ff1bad740cb199ab8e20ce659a37.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\yY8hG8YfUpnnBjZ.exe
      .\yY8hG8YfUpnnBjZ.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\[email protected]\bootstrap.js
    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\[email protected]\chrome.manifest
    Filesize

    35B

    MD5

    d8f056556f9a3886bdcf0fe7f876dbd3

    SHA1

    67b72fe69c91b7f817677d7aa6f4063e57e2ac0f

    SHA256

    bb95bb78bc82509f9bef3b43e51a266feebdf4f061d1b9fce6d97b94e8a243b9

    SHA512

    64e37e13ea3d5ad66d6fc43149b6bda5c138f454e82ffc711cb8ffdde80f34d755261da0b873f20606f31e5a594f59a2db3b50f14f54e9aa624e92bd0caf621b

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\[email protected]\content\bg.js
    Filesize

    9KB

    MD5

    bf337b4295524393fd887aaf2c8034c3

    SHA1

    40f86bc33822430d18d00a2ef2ae3c35168f61d0

    SHA256

    109b203ae6746c09ec954031ab4b9b603ad37617dfe4716f5f881710b343ee75

    SHA512

    5f43767836558583f3281dd94390e877095a9f8ba2ef7d9507e62931d80e1e0b411b8472a757068208cdf35d257e3a58386a88df06edcd1548b8156beece6a94

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\[email protected]\install.rdf
    Filesize

    596B

    MD5

    d3a70cfdd81a2cf78787367e9b6a0f02

    SHA1

    b9112a3b09f2f643d20023fdadd8cc2dbea4f7b0

    SHA256

    25d6244ef3ebce025775e1d3af37c5326da99d50a122004a1b55b08a88f4cb1e

    SHA512

    9ff6f4f35666d51905d349941c5010980850796e6ae632a5610d8d3c180903ce8d441e8358a10332aeb368471dc3894f520d554076de7c7fecc91a7db1243765

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\njlahbdnjgbjcdlelenkohdoooijojci\background.html
    Filesize

    143B

    MD5

    99f944351081fbc2d52ec82b38487a25

    SHA1

    75fa20d437e765d4996f03a4c1665cf554151f69

    SHA256

    a0d965f7b459afc7c4a69a7173a690d0e48b45c7a26b4bdbbe21be233fd717da

    SHA512

    9a362df79cc8b8534dbb52875733bf7eb5a06b44bcfa3ddcfb34aed4c7fab34862cf85ddc953cd4f8bbe9f311ed938958534b1ee0f67ca607d71d98fb4a89c39

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\njlahbdnjgbjcdlelenkohdoooijojci\content.js
    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\njlahbdnjgbjcdlelenkohdoooijojci\lsdb.js
    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\njlahbdnjgbjcdlelenkohdoooijojci\manifest.json
    Filesize

    498B

    MD5

    664e2884e17f23553a19eee317642194

    SHA1

    a28ccc088d6b6692646150f3e8f111e568723fb4

    SHA256

    ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

    SHA512

    b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\njlahbdnjgbjcdlelenkohdoooijojci\znduMu.js
    Filesize

    6KB

    MD5

    621ab29d7081de2347221c55d0b21393

    SHA1

    0b407c58e87d4678a7995cf9783ba5525072a2c5

    SHA256

    8d321ddab6ecaf3d818fb2d56fedf56b1907d0bb74cdb9a5e0690be72fd36fb2

    SHA512

    bc045f8a7552cc5f71902043125f9e0e2189137c564bedc53bb9425aff7d445f8c0a5420b504832e2c413922433b34ff40a5f4c4216d9d45dbc01b5382745889

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\yY8hG8YfUpnnBjZ.dat
    Filesize

    1KB

    MD5

    47e87753b2344b2d02ac3cc10ea25ae5

    SHA1

    55fa5cac1c68d2a8e9123c2a408bf981002d0383

    SHA256

    acef63221646612f5c0d4002f26d09533bec6bf8237890838fb7b7491a1e780a

    SHA512

    89c6e91fb6f3bf0c06a3f88ae32357726d15d072a382df9ef14070be90a94aedb27541f494e9c7f7e1e079ecd82533c1e39e14067e5ac654ff2ef4d01285e6e2

  • C:\Users\Admin\AppData\Local\Temp\7zSD2B.tmp\yY8hG8YfUpnnBjZ.exe
    Filesize

    760KB

    MD5

    dcd148f6f3af3e3b0935c4fcc9f41811

    SHA1

    ee9bdbc7c568c7832d90b85921ab20030b6734cd

    SHA256

    f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

    SHA512

    34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

  • \Users\Admin\AppData\Local\Temp\7zSD2B.tmp\yY8hG8YfUpnnBjZ.exe
    Filesize

    760KB

    MD5

    dcd148f6f3af3e3b0935c4fcc9f41811

    SHA1

    ee9bdbc7c568c7832d90b85921ab20030b6734cd

    SHA256

    f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

    SHA512

    34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

  • memory/1112-54-0x0000000076031000-0x0000000076033000-memory.dmp
    Filesize

    8KB

  • memory/1928-56-0x0000000000000000-mapping.dmp