Analysis
-
max time kernel
133s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:40
Static task
static1
Behavioral task
behavioral1
Sample
c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe
Resource
win7-20221111-en
General
-
Target
c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe
-
Size
932KB
-
MD5
54280a701fd7161a791feb757c31f084
-
SHA1
3d1a32215c2bee5c44c2c42008d0a2253a88c1ae
-
SHA256
c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364
-
SHA512
eefca64f748ea30399579474ed00705589afe9f8af845c728c3d5331ef8453739270fcf759b310cb1687039fdb9517b83c64bbadaab6c89bfdbed37c472f9bbb
-
SSDEEP
24576:h1OYdaOBCZ/iWCvu/2sWsJA/jlt+DHhsR:h1OsPCpYO/dJJDHhsR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
LOLLY1fxatj18UJ.exepid process 4964 LOLLY1fxatj18UJ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
LOLLY1fxatj18UJ.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngcbcoadgljfgedbiadmegmimihbcihc\2.0\manifest.json LOLLY1fxatj18UJ.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngcbcoadgljfgedbiadmegmimihbcihc\2.0\manifest.json LOLLY1fxatj18UJ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngcbcoadgljfgedbiadmegmimihbcihc\2.0\manifest.json LOLLY1fxatj18UJ.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngcbcoadgljfgedbiadmegmimihbcihc\2.0\manifest.json LOLLY1fxatj18UJ.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngcbcoadgljfgedbiadmegmimihbcihc\2.0\manifest.json LOLLY1fxatj18UJ.exe -
Drops file in System32 directory 4 IoCs
Processes:
LOLLY1fxatj18UJ.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI LOLLY1fxatj18UJ.exe File opened for modification C:\Windows\System32\GroupPolicy LOLLY1fxatj18UJ.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini LOLLY1fxatj18UJ.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol LOLLY1fxatj18UJ.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
LOLLY1fxatj18UJ.exepid process 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe 4964 LOLLY1fxatj18UJ.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
LOLLY1fxatj18UJ.exedescription pid process Token: SeDebugPrivilege 4964 LOLLY1fxatj18UJ.exe Token: SeDebugPrivilege 4964 LOLLY1fxatj18UJ.exe Token: SeDebugPrivilege 4964 LOLLY1fxatj18UJ.exe Token: SeDebugPrivilege 4964 LOLLY1fxatj18UJ.exe Token: SeDebugPrivilege 4964 LOLLY1fxatj18UJ.exe Token: SeDebugPrivilege 4964 LOLLY1fxatj18UJ.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exedescription pid process target process PID 5080 wrote to memory of 4964 5080 c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe LOLLY1fxatj18UJ.exe PID 5080 wrote to memory of 4964 5080 c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe LOLLY1fxatj18UJ.exe PID 5080 wrote to memory of 4964 5080 c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe LOLLY1fxatj18UJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe"C:\Users\Admin\AppData\Local\Temp\c346ea75129efc4f8b4d008543566df849ad2123b2642fc4efe8129a8dcd7364.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\LOLLY1fxatj18UJ.exe.\LOLLY1fxatj18UJ.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\[email protected]\chrome.manifestFilesize
35B
MD59a5bffc9fb9aba2fa3409423c6da0b4e
SHA1b8591499a69bb3db56c8e2d25d04a6a86569f502
SHA25695545a23b030f7d97fa7e9fd7e48eed513d971b0157596f7e9c2228da8d9130b
SHA51284c7010523adc5af8f736dd31c5d897a49362c7829fe648787b1f2c4c40da7a3dd10342a02eecf4726d683982c63d681742b51d6ed62cf4fac285570f011fbc0
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\[email protected]\content\bg.jsFilesize
9KB
MD5c0e666da59d7eba799b56a57ba344fb3
SHA1538aee69196adde21398da743483a969e11ce410
SHA2560586d610b1a04200daaeb27c2ee79497fcfc18af15a415b1e13be873fa488bff
SHA51244ade8b215bbdbd6bae90ed15791ac02ad7406990102e3bb38a4c17a5c0891acfc463cc9e48491f85deee5d40a74da9eb91b4097a7df06181f32f809bf5e2f29
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\[email protected]\install.rdfFilesize
595B
MD5ec159a1d797d97c5990e68255805f44d
SHA1049197ba3bfdcbb1fcb543a507c328adb01166d7
SHA256f381f170260e55306592c37cf02dc332aef846aa96e33ade380c732612c40d71
SHA5122e7120cbd0bb238fda9d8a6c1a5797b473bc93bd2b612d2d9e51adc874927bbbcbd082ac2b8d844aec179e658b685354174e815a3ec8183631b8beb03bbfcf49
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\LOLLY1fxatj18UJ.datFilesize
1KB
MD52125c00e0c6a90c52d904f4ada367a71
SHA1118cead8473e4487ee4836edde5e6a8362d788a6
SHA2565e5177d719f5ade6aa6e55d107225aa0245a5200dfd51c265fda7b076d5b7d5b
SHA512b4f77ad25c9c130555fcd3f0537ec22425c6b179b225e44c0ebd7c14b0aff9dcc9cefe984ba105b7786ce8f56fe43a7155aa6c7626b513dac1ef367edb72cd2b
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\LOLLY1fxatj18UJ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\LOLLY1fxatj18UJ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\ngcbcoadgljfgedbiadmegmimihbcihc\DTHI.jsFilesize
6KB
MD53a85c92c794b216e2d1e94aa1ca4994c
SHA159697f5d0abcd2a3efe61cf72a954289b962eecb
SHA256b6a154adc5e689a3ee9c9e4a50dc92d2ec366191cab8421a185e3c3bdf3f42d7
SHA512ab5ad559e07e48b5975934725d8cb5d2dc979641ba49a22be0ed66df3d17f62aebc691065f5dc78ed439a012dc9b4fa769bc59ed5f853781915dfbfca1678ea0
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\ngcbcoadgljfgedbiadmegmimihbcihc\background.htmlFilesize
141B
MD58dc876f456b3f3deeffb0c7837c4438d
SHA16ea8fd1046262fc46f388e0059b076670840312e
SHA2568785c4168d4c0879601345fc23f206262c56f7cc964666187fdecc15423536d7
SHA512f1fd658f2b063d3a1b31a2fb60cd63cc973fb1d55b536c7b80b0984a1a8b4875a08f18f03be48bf1dcfa2625132562d7a3c7f697631dd74b48d95c37b164fd35
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\ngcbcoadgljfgedbiadmegmimihbcihc\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\ngcbcoadgljfgedbiadmegmimihbcihc\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSE6AB.tmp\ngcbcoadgljfgedbiadmegmimihbcihc\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4964-132-0x0000000000000000-mapping.dmp