c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe
Size

932KB
MD5

2cd491b32d0fb62703e62564422a1db8
SHA1

fe5fe64db36b91a25aeeff421d0afcf93a160226
SHA256

c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295
SHA512

946347a65b0e43166dfe025f1e05a504e217dcec0eb6c76d7bafa5fa113fb6b908164ebd45f9b28ed39d902641a71614dabede51f89442d39c0d3dd642fcac7d
SSDEEP

24576:h1OYdaODCZ/iWCvu/2sWsJA/jlt+DHhss:h1OsFCpYO/dJJDHhss

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

4Gv3eTDdeQqneQK.exe

pid process

2604 4Gv3eTDdeQqneQK.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

4Gv3eTDdeQqneQK.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcmeogogodfhnhiejnhdbhcbbmhoomll\2.0\manifest.json	4Gv3eTDdeQqneQK.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcmeogogodfhnhiejnhdbhcbbmhoomll\2.0\manifest.json	4Gv3eTDdeQqneQK.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcmeogogodfhnhiejnhdbhcbbmhoomll\2.0\manifest.json	4Gv3eTDdeQqneQK.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcmeogogodfhnhiejnhdbhcbbmhoomll\2.0\manifest.json	4Gv3eTDdeQqneQK.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcmeogogodfhnhiejnhdbhcbbmhoomll\2.0\manifest.json	4Gv3eTDdeQqneQK.exe

Drops file in System32 directory 4 IoCs

Processes:

4Gv3eTDdeQqneQK.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	4Gv3eTDdeQqneQK.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	4Gv3eTDdeQqneQK.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	4Gv3eTDdeQqneQK.exe
File opened for modification	C:\Windows\System32\GroupPolicy	4Gv3eTDdeQqneQK.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

4Gv3eTDdeQqneQK.exe

pid	process
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe
2604	4Gv3eTDdeQqneQK.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

4Gv3eTDdeQqneQK.exe

description	pid	process
Token: SeDebugPrivilege	2604	4Gv3eTDdeQqneQK.exe
Token: SeDebugPrivilege	2604	4Gv3eTDdeQqneQK.exe
Token: SeDebugPrivilege	2604	4Gv3eTDdeQqneQK.exe
Token: SeDebugPrivilege	2604	4Gv3eTDdeQqneQK.exe
Token: SeDebugPrivilege	2604	4Gv3eTDdeQqneQK.exe
Token: SeDebugPrivilege	2604	4Gv3eTDdeQqneQK.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe

description	pid	process	target process
PID 3368 wrote to memory of 2604	3368	c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe	4Gv3eTDdeQqneQK.exe
PID 3368 wrote to memory of 2604	3368	c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe	4Gv3eTDdeQqneQK.exe
PID 3368 wrote to memory of 2604	3368	c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe	4Gv3eTDdeQqneQK.exe

C:\Users\Admin\AppData\Local\Temp\c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe
"C:\Users\Admin\AppData\Local\Temp\c2c90e7c37386bf47e7c9c7f25cad9ea84f5dffde7a40d905d25e5bbc98e0295.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368

C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\4Gv3eTDdeQqneQK.exe
.\4Gv3eTDdeQqneQK.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\4Gv3eTDdeQqneQK.dat
Filesize
1KB

MD5
a19cf54331c4895a5bc14fcedce55aa3

SHA1
131570b60305e755f6426ac41f194538d40d6bc1

SHA256
a6f7a67a65697e79730c2926c14b714b13a8a59f716a07e2170e7a7dc1fd3d1e

SHA512
a7c8ab7264d595091409b20cb94f6f0a7d537a1c82e3318590ed3718343c5ca5e534aaa512980550c12b30c47257994a6358153d3ab4add0eab0ea6a86df9e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\4Gv3eTDdeQqneQK.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\4Gv3eTDdeQqneQK.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\Ef1@k.edu\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\Ef1@k.edu\chrome.manifest
Filesize
35B

MD5
96f0073999e2062c5111b71aaeea0a0b

SHA1
d6199a78cb2f8bb9768312c747d8189b88a7ce4e

SHA256
6f08c70a802810db97adcd4a17d66657ae6dd1f579b5430e6873d815b522ae77

SHA512
224b7e48164bb62bf331cdc2097a7dfe5107a6bb500d6a63e14939a6831e2c44582055359dea513e57e553adb05d9a79be784a97d9861ddea77ccb56a9a8476a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\Ef1@k.edu\content\bg.js
Filesize
9KB

MD5
70fe9e8b901850a1cf2a33b0ba5b8bc4

SHA1
c2419081789b345e65af203cde544376b4940ebb

SHA256
0bdf1aa4688ea4449dea15de27eee4dc7b2701fcb6cd964f394830d533e58088

SHA512
49280157cbcb034176689a356287b431dc7bb59b2992ae83defd9e2eb044c971b3d7a0dbc59b922de7108c06435cab616172829688504546fb9b66a0881ea91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\Ef1@k.edu\install.rdf
Filesize
591B

MD5
9c023508c17e8f383804b5ca00e2d4dc

SHA1
abb07d1b85dc910889cb3091d7143c4a919f5913

SHA256
ccd13efabb91064dd63dd471bdd71d1cd34638c7bff805c47f07f50cfb07ac22

SHA512
b2b4863489d1adcec3771e85173747b51c45f34062c3c60a4d8ad1092ea529a887de577a876bdc8526a7425bc5a222588bffbffdb668ea8cf6ef5c6fcddcd43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\kcmeogogodfhnhiejnhdbhcbbmhoomll\Pu8Hy307wn.js
Filesize
6KB

MD5
a5d2c9995124c43ece3d58e3b6c48818

SHA1
dd8cc4bfd8122fb8950634f282a0436bc9183b06

SHA256
bc18f9a3cdba88f9ad05d8995702dff6786d2cc06167944809f58b4a9afa7487

SHA512
a7125478479b4f3be24bc4be8eec0df8202a1ad0a8996f10fa9aced9eda0a247918fd5363067a4203e1b5697686a8e60546bd66b80ad1a13369d3dac909533f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\kcmeogogodfhnhiejnhdbhcbbmhoomll\background.html
Filesize
147B

MD5
c74bdaceef2a34fcd2f009d600291215

SHA1
91404a002339943015b25abb6a63050d2038c862

SHA256
7ae5c2cb37dda13a77f47fae2d51dd782f2e6137076fda9ac072bf1c388b3678

SHA512
5d9811e1157393355766595c9937ff4be3ac4dfdeda3bd4f4644de8b55810ff27de559c78f7a3950f4c9871439fcd594909d8b3b30ece1bef014593e23ecfff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\kcmeogogodfhnhiejnhdbhcbbmhoomll\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\kcmeogogodfhnhiejnhdbhcbbmhoomll\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBE34.tmp\kcmeogogodfhnhiejnhdbhcbbmhoomll\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/2604-132-0x0000000000000000-mapping.dmp

Download