c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9

Analysis

max time kernel
186s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe
Size

931KB
MD5

6c489e38c615d8455822e3f38ee3aa47
SHA1

3b64d0585d786f474d467202d77ff98c2da0cb60
SHA256

c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9
SHA512

6d99bb22ab5da12131e1f6a96ef4ccc6f5d741378c71a521f817c13faf8872aad5876ccce7dc676e0c48ad3b68ad34f07fff7a873bf77e4e19b6cc39ffae54d0
SSDEEP

24576:h1OYdaOLCZ/iWCvu/2sWsJA/jlt+DHhsW:h1OsNCpYO/dJJDHhsW

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

0YmAvEoyXzvOedH.exe

pid process

2888 0YmAvEoyXzvOedH.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

0YmAvEoyXzvOedH.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\neammcldchcdenkmlaloojdjdajeklie\2.0\manifest.json	0YmAvEoyXzvOedH.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\neammcldchcdenkmlaloojdjdajeklie\2.0\manifest.json	0YmAvEoyXzvOedH.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\neammcldchcdenkmlaloojdjdajeklie\2.0\manifest.json	0YmAvEoyXzvOedH.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\neammcldchcdenkmlaloojdjdajeklie\2.0\manifest.json	0YmAvEoyXzvOedH.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\neammcldchcdenkmlaloojdjdajeklie\2.0\manifest.json	0YmAvEoyXzvOedH.exe

Drops file in System32 directory 4 IoCs

Processes:

0YmAvEoyXzvOedH.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	0YmAvEoyXzvOedH.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	0YmAvEoyXzvOedH.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	0YmAvEoyXzvOedH.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	0YmAvEoyXzvOedH.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

0YmAvEoyXzvOedH.exe

pid	process
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe
2888	0YmAvEoyXzvOedH.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

0YmAvEoyXzvOedH.exe

description	pid	process
Token: SeDebugPrivilege	2888	0YmAvEoyXzvOedH.exe
Token: SeDebugPrivilege	2888	0YmAvEoyXzvOedH.exe
Token: SeDebugPrivilege	2888	0YmAvEoyXzvOedH.exe
Token: SeDebugPrivilege	2888	0YmAvEoyXzvOedH.exe
Token: SeDebugPrivilege	2888	0YmAvEoyXzvOedH.exe
Token: SeDebugPrivilege	2888	0YmAvEoyXzvOedH.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe

description	pid	process	target process
PID 3668 wrote to memory of 2888	3668	c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe	0YmAvEoyXzvOedH.exe
PID 3668 wrote to memory of 2888	3668	c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe	0YmAvEoyXzvOedH.exe
PID 3668 wrote to memory of 2888	3668	c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe	0YmAvEoyXzvOedH.exe

C:\Users\Admin\AppData\Local\Temp\c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe
"C:\Users\Admin\AppData\Local\Temp\c36076ac892b5e172acc042d2679b32b677a0144db94c217acb7c9f9da6766b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\0YmAvEoyXzvOedH.exe
.\0YmAvEoyXzvOedH.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\0YmAvEoyXzvOedH.dat
Filesize
1KB

MD5
07539ddda59ffed9d6a53a8885df480c

SHA1
b1826077b2a44852d3aa7e2a33a7ae6a96fbb8ac

SHA256
6ae2a1d771d363bae6e65ae42926993250b9ba2ff32b6a2672c81ce9648fe07f

SHA512
cafc8694aa00fd26f18021c05c7d2853cbce2ea63d3cc9d32a24bd517f0e0256cc99249d9daa60b01f3427619de9e87e0a36c1c90afd9f10b29c1d833335c92f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\0YmAvEoyXzvOedH.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\0YmAvEoyXzvOedH.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\n8J@QoHin.com\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\n8J@QoHin.com\chrome.manifest
Filesize
35B

MD5
b0553ebb94d470de23c4f4cb87105baa

SHA1
dc8ac1c570ee9c3a1a2eb9615a37e2ebd1297adc

SHA256
1c72a1ded227643bdfcd7264b4a699d00c653f80c1257be5ece83a9e491eb548

SHA512
a596bc53a0efd001a7c533c78ee6af09268643dac689ef46e42b28c083f6a1903dd6647486ae21363b93bf00af187224d8c543bfa810f5799899637a363233e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\n8J@QoHin.com\content\bg.js
Filesize
8KB

MD5
624b2d57b3ad0ba179ed2e890d18f533

SHA1
7e1416bc4b6c1b2520f4706b1a2526f8835d5b3f

SHA256
6ef12c36641c5f067a931f10de9c51004a6104224013a60e884b1716bac882bf

SHA512
93f249cead9d0abce8c80d52b9a8036e156fe5396c5305755f3feaf3479fcf58a3db111b6718d924c88664bb6b6af7c74ef435b773dd8acc3e4d00e4bb3deb95

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\n8J@QoHin.com\install.rdf
Filesize
595B

MD5
27847ddd6742035a246db4f7e3e6f7b9

SHA1
14b97cac98b8ef354ca8c995fd575769560b4096

SHA256
ad361c9ac9ab594330e617b322322bdda4d3ca0aef4a15a33d299a71bde5d60d

SHA512
101bff2049f2c3a455736b0a4506505163f9f9255fe15d0eb6387c4bf54a3d703e49765c745918387f2d4f62d86f89700dc5935df14ab0fdf2d13920eb1089c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\neammcldchcdenkmlaloojdjdajeklie\background.html
Filesize
145B

MD5
85681ec32c94289854ad10abee501888

SHA1
850ba8f395400ae523f981922299db3962c00419

SHA256
898461dec0bb566bf4d1839c8bdc7a26f7c87d8fc6fafbbbec5954dd6d76d34c

SHA512
efea0bb5b9e44f72365783477cb89da43bec7690ef09b9c907f253740baff0143837e361d8986204c0283c94d838c75252dcae0c5ad226415f8e7d7aa78ff0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\neammcldchcdenkmlaloojdjdajeklie\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\neammcldchcdenkmlaloojdjdajeklie\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\neammcldchcdenkmlaloojdjdajeklie\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EBE.tmp\neammcldchcdenkmlaloojdjdajeklie\oD5mvuIN.js
Filesize
6KB

MD5
35d69f293d18afc5951d2218a4c17fd0

SHA1
48f24bbf1ff31dd97884f17a0e19b60422a14639

SHA256
d430b660b6a1dbea683d204fca5699570cfd1e07ea9730967d809183dada1dc1

SHA512
6ce79b026ccdb288245dd5ba0b6ba703d273a926e5023ff1f131859c9ae8fa20c6110c1bd8647227b91993908c14317ba38a781e95206881b452b70604c533a1

Download Submit
memory/2888-132-0x0000000000000000-mapping.dmp

Download