Analysis
-
max time kernel
168s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:40
Static task
static1
Behavioral task
behavioral1
Sample
c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe
Resource
win7-20221111-en
General
-
Target
c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe
-
Size
920KB
-
MD5
c154f1ef6b97f94b01ffcbd6f297c6bd
-
SHA1
4129cbe24423001139c47bad91a8617b78307004
-
SHA256
c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9
-
SHA512
2322d257dda31ead57c7dd5de11d5838052220c723b15b199fa9ac4407390aa2b83bacbd4762fdf8efaced7304e6aeec9d7d7312910d0867ae9c6e4c43fc77b7
-
SSDEEP
24576:h1OYdaOeMtdHAqcdDVhYwiei7+EpFAh/kKJ:h1OsbPHVmVhYwiLtKkKJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
dzg4T2tbUzWon6n.exepid process 3568 dzg4T2tbUzWon6n.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
dzg4T2tbUzWon6n.exedescription ioc process File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlgpghgbcmcndapdnalbolhpogjapkok\1.3\manifest.json dzg4T2tbUzWon6n.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlgpghgbcmcndapdnalbolhpogjapkok\1.3\manifest.json dzg4T2tbUzWon6n.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlgpghgbcmcndapdnalbolhpogjapkok\1.3\manifest.json dzg4T2tbUzWon6n.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlgpghgbcmcndapdnalbolhpogjapkok\1.3\manifest.json dzg4T2tbUzWon6n.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlgpghgbcmcndapdnalbolhpogjapkok\1.3\manifest.json dzg4T2tbUzWon6n.exe -
Drops file in System32 directory 4 IoCs
Processes:
dzg4T2tbUzWon6n.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol dzg4T2tbUzWon6n.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI dzg4T2tbUzWon6n.exe File opened for modification C:\Windows\System32\GroupPolicy dzg4T2tbUzWon6n.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini dzg4T2tbUzWon6n.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
dzg4T2tbUzWon6n.exepid process 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe 3568 dzg4T2tbUzWon6n.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exedescription pid process target process PID 744 wrote to memory of 3568 744 c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe dzg4T2tbUzWon6n.exe PID 744 wrote to memory of 3568 744 c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe dzg4T2tbUzWon6n.exe PID 744 wrote to memory of 3568 744 c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe dzg4T2tbUzWon6n.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe"C:\Users\Admin\AppData\Local\Temp\c321395a75eed9fbab6d441fab025125f0a1cda1cf461091ef4bc16432c540a9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\dzg4T2tbUzWon6n.exe.\dzg4T2tbUzWon6n.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\1evfZpQeB@E.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\1evfZpQeB@E.com\chrome.manifestFilesize
35B
MD57a6d44cfacc7b26e29637cc45c08d4d8
SHA1637f51e817a5c2e23aeb8c630f75498f7c68d6d7
SHA25626af17e3dfaac777bd7af3465d888efbfab276cd4f326cff30b6500bbf6ab294
SHA512e05b97cdcd64c125ace6475d5285e2b002583803c5d57d4be26dcd8c1d37e82d73127beda09c3b89f7e4132f2235e9503c9aa79de125befb1ca052e5a4738ded
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\1evfZpQeB@E.com\content\bg.jsFilesize
8KB
MD532cb07ca546b13160d14f54aef225ece
SHA1fa5dc8d93e782dddbd0ea7b85ad7966514edc43c
SHA256fcf743c752bab7283d8ba50137860eec35d958ee26663c2b474d423f77f6dfb1
SHA512d6d0d79234ee7a124fb51c2b9e568d60b68f2ba868d3d5d72e25412ea8b959a2d05d6ab199d896c63bbbb8dcc30c3feb20905b066702936dded1c0a390a1a32d
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\1evfZpQeB@E.com\install.rdfFilesize
597B
MD5354fbcba959dce4df527e9567f658b5e
SHA1ad49fc487141545d550ba98ed9e1bfe6a3952d10
SHA256a3b6a22bc8e65d177676682ea4d29215194ad4f41c8e8ca1b5b252c51367a743
SHA512f0ab94837c84b5bc484a05829e6a03b874ae09c986866b339b8770d03ad5e1612a1d0375b841f7ed8ecd709a1fd9982acdd1cb45f66cbef17a60edc03c22c79d
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\dzg4T2tbUzWon6n.datFilesize
1KB
MD5928ed2e7dc03dccd536007804d68b6fd
SHA18c2eeeaaa6ca1bf086d85d06bd330b2aec21bd94
SHA256ccd8754cc227fce2d098c70998d4d1c7ada2ff2a9c460f1852248374307f12fc
SHA51256dd457c7b4d149034d78cb37f010993875413ccb343ce1a25340a50abcd677f71bb7f0d91043ed75c00fab9f66a8ff294984c7825d017910f766aabe592c2fc
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\dzg4T2tbUzWon6n.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\dzg4T2tbUzWon6n.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\nlgpghgbcmcndapdnalbolhpogjapkok\Cg9sKsGdn.jsFilesize
6KB
MD5444c3736aa680391a2aaf1d5adf1c490
SHA17b0c064a9cf9e794b7a9a260b4c1f72eddcc07c4
SHA256f498a9391f225dfb8844aedac172bb9652baca5dbb33bbfc11949360c17570ad
SHA512a39e440e41be250a1e68e58137e44c2465c266215dd3be884ecddda247e16d62038a83461c8611a034a502078a49a49e4511bab9b3b518d663a2734abb6440a4
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\nlgpghgbcmcndapdnalbolhpogjapkok\background.htmlFilesize
146B
MD54b3845d995a791cbcb3ad58fcd936636
SHA106e93ba5b4ea521cd33e86b09437fe81189d176b
SHA2565faf0ac88c19e255a0d670a58a1653cc018989ee531a8bbf51cf05bd2fd24619
SHA512b259c3fcd7daab2593dd1b05055568f1dc34da4229da34f57a63b845cad0f44cb833f0c0035f1c8d40065e82c2debb37b45de6f47d31030225f58b882b9dd251
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\nlgpghgbcmcndapdnalbolhpogjapkok\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\nlgpghgbcmcndapdnalbolhpogjapkok\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSE87.tmp\nlgpghgbcmcndapdnalbolhpogjapkok\manifest.jsonFilesize
498B
MD5664e2884e17f23553a19eee317642194
SHA1a28ccc088d6b6692646150f3e8f111e568723fb4
SHA256ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191
SHA512b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb
-
memory/3568-132-0x0000000000000000-mapping.dmp