c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe
Size

920KB
MD5

df8da146e8761fa7f9b297bebb038a70
SHA1

9bbe0be95053c48e41c20d8a27a324a36c217c52
SHA256

c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6
SHA512

0f0bbbf441eebf5cefeeacb961498a8ce8eb4c4af58eb8da62da0826c1f89fc2527266ddbe5c0b06f51ad2f7c3cd712624cd306d95a3ce1bfdf034178914a716
SSDEEP

24576:h1OYdaOwMtdHAqcdDVhYwiei7+EpFAh/kKs:h1Os9PHVmVhYwiLtKkKs

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

q3pJ6pd44NoFIs1.exe

pid process

2548 q3pJ6pd44NoFIs1.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

q3pJ6pd44NoFIs1.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\emegnpddbcmniekncakaflofhecncffm\2.0\manifest.json	q3pJ6pd44NoFIs1.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\emegnpddbcmniekncakaflofhecncffm\2.0\manifest.json	q3pJ6pd44NoFIs1.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\emegnpddbcmniekncakaflofhecncffm\2.0\manifest.json	q3pJ6pd44NoFIs1.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\emegnpddbcmniekncakaflofhecncffm\2.0\manifest.json	q3pJ6pd44NoFIs1.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\emegnpddbcmniekncakaflofhecncffm\2.0\manifest.json	q3pJ6pd44NoFIs1.exe

Drops file in System32 directory 4 IoCs

Processes:

q3pJ6pd44NoFIs1.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	q3pJ6pd44NoFIs1.exe
File opened for modification	C:\Windows\System32\GroupPolicy	q3pJ6pd44NoFIs1.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	q3pJ6pd44NoFIs1.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	q3pJ6pd44NoFIs1.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

q3pJ6pd44NoFIs1.exe

pid	process
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe
2548	q3pJ6pd44NoFIs1.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

q3pJ6pd44NoFIs1.exe

description	pid	process
Token: SeDebugPrivilege	2548	q3pJ6pd44NoFIs1.exe
Token: SeDebugPrivilege	2548	q3pJ6pd44NoFIs1.exe
Token: SeDebugPrivilege	2548	q3pJ6pd44NoFIs1.exe
Token: SeDebugPrivilege	2548	q3pJ6pd44NoFIs1.exe
Token: SeDebugPrivilege	2548	q3pJ6pd44NoFIs1.exe
Token: SeDebugPrivilege	2548	q3pJ6pd44NoFIs1.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe

description	pid	process	target process
PID 5072 wrote to memory of 2548	5072	c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe	q3pJ6pd44NoFIs1.exe
PID 5072 wrote to memory of 2548	5072	c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe	q3pJ6pd44NoFIs1.exe
PID 5072 wrote to memory of 2548	5072	c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe	q3pJ6pd44NoFIs1.exe

C:\Users\Admin\AppData\Local\Temp\c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe
"C:\Users\Admin\AppData\Local\Temp\c2c9765229abc01ea6d9d5902627e8d58d486f0a77867f3672b6d7bd418336a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\q3pJ6pd44NoFIs1.exe
.\q3pJ6pd44NoFIs1.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\emegnpddbcmniekncakaflofhecncffm\background.html
Filesize
144B

MD5
688b5d6dfedfee7c49a1218761e0fdd1

SHA1
ae8cb17b202da0540f1d275012c01c0b966ef7ce

SHA256
8a0d3fdcf72865e62585e8eecb55265e8736ecce48a2ca0da105335246486497

SHA512
99bf03fda0a6564f4de0393819669834420711e723fc0c6a167e77b6b03f5450dab389b67d1e468186b9e8a3fafb25aa7dea01a4630ac8ba5dfc84f866be1c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\emegnpddbcmniekncakaflofhecncffm\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\emegnpddbcmniekncakaflofhecncffm\dCcaAN7.js
Filesize
6KB

MD5
f1613f872cfa5080a780425ecf864002

SHA1
d035f8d2551a59f2dcd75a013b568c6b64172967

SHA256
71a0934ffcc1283bb7dcb97df7e87aa494c6c0bded99ec1d94ea15bb44081f9b

SHA512
ca2dbb94eda0fbbc546fa4a943a46267a1bad50f87ecb1ce242b5590cd375a18097fc5ad56f66d4285d8036373bc75d8aebe2003eb96eebae1ff2f51bdc58d1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\emegnpddbcmniekncakaflofhecncffm\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\emegnpddbcmniekncakaflofhecncffm\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\q3pJ6pd44NoFIs1.dat
Filesize
1KB

MD5
f3e27517841c5ca67c88d945b8bf337f

SHA1
c7638e265dcc39f26fd48f54af2b1cd60256f580

SHA256
e8b8c015e1b7d12ddef0dbe5565e32f6b2b129ca856a37c7d875b78ca20d282e

SHA512
8345b30fad8b30324d6eba78308585a6cfd00c39ebff78e424a1d0bfcc1d4c460feaf1458f7dab385e7d0d49237fb46a674393bf36acbc67bc968dcc4170a819

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\q3pJ6pd44NoFIs1.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\q3pJ6pd44NoFIs1.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\t9@NR.net\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\t9@NR.net\chrome.manifest
Filesize
35B

MD5
47e89a69ff0f4b44ca373606038963ff

SHA1
4af5c7c701c3c5ba3a7e8203eed92eaefee242d0

SHA256
1e6c82750dc68378d645780465ea26d027db8caa9da5c8f65332e7347df272c9

SHA512
0ff01058eb9d7a5469d9141b79241e5390f0219d725bad25f22a17693122a6338ea0c0fc9d67f64fe9257d37d42cb0a26b3cff77ec76cf6707832bd458624b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\t9@NR.net\content\bg.js
Filesize
8KB

MD5
2f95062dd3cafbdc1c1b34ceab3e1a18

SHA1
46ba20bc7fc0dd5d2b4b8dddc787005e06465da1

SHA256
9847f33f3b9e6c29b4730c72242b165f85219e9ab815d9725458693fd85afbf6

SHA512
b63c9615c8cf5551065565163eb608e0a1a42d9b93f1e24d05955f62bf4414c39bb96277c31e0ffe7f213e944b342b4477550bd4f6a71c924b016c8659b3a726

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAFAD.tmp\t9@NR.net\install.rdf
Filesize
591B

MD5
8f6bff3d16db340d6fb854ee93a96293

SHA1
aeec1e2e83dfaa1167e0f385ff760ac94718a57f

SHA256
7930637b6efcae4e0dd57d8692b6ad971ac27678a25417e11bfa13525b9c6728

SHA512
d34db2209e51d888ae669ea2cd8e6955099e48c8c96924b317974ba0c88646c1d2d49a711f726360f61abb55d59b6187b7485d1fc109c0c8cd04e2ff48694d4d

Download Submit
memory/2548-132-0x0000000000000000-mapping.dmp

Download