Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:40
Static task
static1
Behavioral task
behavioral1
Sample
c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe
Resource
win7-20220812-en
General
-
Target
c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe
-
Size
2.5MB
-
MD5
26ae1e973b5f0dec75fce7eda6f6aea3
-
SHA1
5228955356af4c5249c2dc9befedcafe47e4e9a3
-
SHA256
c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3
-
SHA512
2cb723961e5ce7ad3e6db90b73fb8cb060ae7e71e584ca22b5b4b26718bef33e04d883304f30cfd665138fd1ecea70a75b826fd9eb92c5ab072bd1679570c7e5
-
SSDEEP
49152:h1OsJsNQH0eNGTTOxTnkSM1XN+QMz3p6bOkAk+YetEW6FOCMwEFhjzdUwN:h1OuH0eNGunkt3+1z3p6iVCi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
fe8RukedEuQtizc.exepid process 1148 fe8RukedEuQtizc.exe -
Loads dropped DLL 4 IoCs
Processes:
c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exefe8RukedEuQtizc.exeregsvr32.exeregsvr32.exepid process 2024 c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe 1148 fe8RukedEuQtizc.exe 1564 regsvr32.exe 1456 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
fe8RukedEuQtizc.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\adoedpkkioebdelojpcaigllecmiijpn\2.0\manifest.json fe8RukedEuQtizc.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\adoedpkkioebdelojpcaigllecmiijpn\2.0\manifest.json fe8RukedEuQtizc.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\adoedpkkioebdelojpcaigllecmiijpn\2.0\manifest.json fe8RukedEuQtizc.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
fe8RukedEuQtizc.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects fe8RukedEuQtizc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ fe8RukedEuQtizc.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} fe8RukedEuQtizc.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} fe8RukedEuQtizc.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} fe8RukedEuQtizc.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
fe8RukedEuQtizc.exedescription ioc process File created C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dll fe8RukedEuQtizc.exe File opened for modification C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dll fe8RukedEuQtizc.exe File created C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.dll fe8RukedEuQtizc.exe File opened for modification C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.dll fe8RukedEuQtizc.exe File created C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.tlb fe8RukedEuQtizc.exe File opened for modification C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.tlb fe8RukedEuQtizc.exe File created C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.dat fe8RukedEuQtizc.exe File opened for modification C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.dat fe8RukedEuQtizc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
fe8RukedEuQtizc.exepid process 1148 fe8RukedEuQtizc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exefe8RukedEuQtizc.exeregsvr32.exedescription pid process target process PID 2024 wrote to memory of 1148 2024 c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe fe8RukedEuQtizc.exe PID 2024 wrote to memory of 1148 2024 c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe fe8RukedEuQtizc.exe PID 2024 wrote to memory of 1148 2024 c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe fe8RukedEuQtizc.exe PID 2024 wrote to memory of 1148 2024 c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe fe8RukedEuQtizc.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1148 wrote to memory of 1564 1148 fe8RukedEuQtizc.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe PID 1564 wrote to memory of 1456 1564 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe"C:\Users\Admin\AppData\Local\Temp\c32fd5fc9687036de0906f77c66fc74f676cfaffa8c55b51e682f0d94e7108d3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\fe8RukedEuQtizc.exe.\fe8RukedEuQtizc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.datFilesize
6KB
MD5d0ad90b6b31a9bc0832d53f43f92aa87
SHA1fe42b1731ceb568e5fc87c48500a04143b9bd188
SHA2563d07eb963caaf57e70c83400f918f793539c385439ec8fad42e8a06642e6f2c9
SHA512d642dfdba8efb89fd155754a71baa34aa8d18439897f3f247e1b467efc7b8d5249417f91933665c15c70d5c03cf1102ce01f1402b9a5fdef882694e4e5864849
-
C:\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\HZg@gu8R21.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\HZg@gu8R21.org\chrome.manifestFilesize
35B
MD5ea72afd20368dcd0a2062b67f13e0924
SHA1dbd4a0906fcc3370bcb6d67693c3dad3c4aafeaa
SHA256ed4e107a92faa09df9b6877de89f1cd440b6e1b0e6c7d07fa3bc41f26069bc19
SHA5126f8f921cfcbe3dbc3950edd16fa9c55d74ea383a9f9d06c94ac041dd9c6aebcc5c27e23fe01479e09b21869a7eaf199bea273a70bb4565bd1fc8a4195624262f
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\HZg@gu8R21.org\content\bg.jsFilesize
7KB
MD5a20967551ec93e564b607da3387cda10
SHA1b49dc0d059caafd250ed61db4109b6f4a7d481ba
SHA256d0487c9ded5ce3a18a947fa71fc42a664563e404fdf75ff689d2abeaf967f3e6
SHA51261c338ad83c335e95ce8e2a3c558d8edd7859b82c9911531ff12f166effaf09e3cb44b7d03a55f85e17316028f24fd5d131379e00473d01f53861bd55f90cd25
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\HZg@gu8R21.org\install.rdfFilesize
596B
MD57204242ddd55f13b9b0bcfaf0478f73f
SHA1e3b1b612e6a0ac2a000da5f535fe40f8a411a4f7
SHA25669d498d8edd3944b9bbe0576d200c9d9e555c477aee2d252030a30b1148cfc2f
SHA5124ff45c3bd53b7500e220c660fbfcf9c72bf0d64a9a5d7a63c9fbc6d3d844cd30d2d76c9d31b338fe505b6354ee6e3229e7674e436f385bc9cdcd0549f4ea8796
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\O6eOKtHrjhD5ws.dllFilesize
754KB
MD50ea14ffbf9bc129f87d5a633ca028a12
SHA1c91e00a9d6590556a4c13a46cb6c934f84cf2b2b
SHA2569206058e3e04af4fb8d5c05ae8f088cf0a289ea0e4cd692c4f2d76439adb0d47
SHA5120cfd075335346690ead8c5aef2340b56ce07c59d6243ad102fee0053d64f1a7847e56ba27f5bbcac4048f2c1cf70038e7cdffafe1cc28994603fdd65d2bf7bb2
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\O6eOKtHrjhD5ws.tlbFilesize
3KB
MD54ab2bba691d66beca01f76ac65546fe8
SHA116f05ce91f3e2fe4b43452e24d56836fc65615af
SHA25612816936003f13a1711de73328e38f311926a4cc9d1a836f46c9ccc02b6fb06f
SHA512f034390bfd57618bbfd218c3df9e465dda8f4fa51fc0445c74e246472a4cde2bc0bfe4607cbc8cb31ac0edff62a84e954179fadddc2b644b8726cfa3e01694a2
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\O6eOKtHrjhD5ws.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\adoedpkkioebdelojpcaigllecmiijpn\P.jsFilesize
5KB
MD52bead333ab101433ed98295d603e0af1
SHA13653bf62b491a15ecaf38646bcd33c36df33235b
SHA2566053050f1281ec4706cb700026acc3cb0620c9cd48c759071733bd29803aa130
SHA512eeca949c3e5de5b5e493e8ea5d30ccd9178517929c2c36c6f9d886e25eafda4cd36fb67645148de1ec5ea3b99b8118411be50c14b128fe596d3bf377a7f72bc1
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\adoedpkkioebdelojpcaigllecmiijpn\background.htmlFilesize
138B
MD51f87601796fa3cbcfe357523c6776694
SHA122ac49ecab70c09f35ac388f04244e62208c7b6d
SHA25682aa95cc0fdece5b48bcbabdc4ed95850d2924e846117a8d3533f2b5c9dc9b94
SHA512b798b9eec2ed97ca40b1f8ba52335fc1c7eab83a4c8581f81717036bb76787f8f0613e3efe19f475741056691425056e49dbad946d8a3665b9d8109c3cefd6bd
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\adoedpkkioebdelojpcaigllecmiijpn\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\adoedpkkioebdelojpcaigllecmiijpn\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\adoedpkkioebdelojpcaigllecmiijpn\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\fe8RukedEuQtizc.datFilesize
6KB
MD5d0ad90b6b31a9bc0832d53f43f92aa87
SHA1fe42b1731ceb568e5fc87c48500a04143b9bd188
SHA2563d07eb963caaf57e70c83400f918f793539c385439ec8fad42e8a06642e6f2c9
SHA512d642dfdba8efb89fd155754a71baa34aa8d18439897f3f247e1b467efc7b8d5249417f91933665c15c70d5c03cf1102ce01f1402b9a5fdef882694e4e5864849
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\fe8RukedEuQtizc.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
C:\Users\Admin\AppData\Local\Temp\7zS406B.tmp\fe8RukedEuQtizc.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.dllFilesize
754KB
MD50ea14ffbf9bc129f87d5a633ca028a12
SHA1c91e00a9d6590556a4c13a46cb6c934f84cf2b2b
SHA2569206058e3e04af4fb8d5c05ae8f088cf0a289ea0e4cd692c4f2d76439adb0d47
SHA5120cfd075335346690ead8c5aef2340b56ce07c59d6243ad102fee0053d64f1a7847e56ba27f5bbcac4048f2c1cf70038e7cdffafe1cc28994603fdd65d2bf7bb2
-
\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
\Program Files (x86)\GoSave\O6eOKtHrjhD5ws.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
\Users\Admin\AppData\Local\Temp\7zS406B.tmp\fe8RukedEuQtizc.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
memory/1148-56-0x0000000000000000-mapping.dmp
-
memory/1456-77-0x0000000000000000-mapping.dmp
-
memory/1456-78-0x000007FEFC251000-0x000007FEFC253000-memory.dmpFilesize
8KB
-
memory/1564-73-0x0000000000000000-mapping.dmp
-
memory/2024-54-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB