Analysis
-
max time kernel
32s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:41
Static task
static1
Behavioral task
behavioral1
Sample
c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe
Resource
win7-20220812-en
General
-
Target
c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe
-
Size
931KB
-
MD5
8b5586ba4a9198437a2c39982f1fb2b3
-
SHA1
cbbc708dc976d47f1c76c2e0f93bd9037cab7b68
-
SHA256
c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b
-
SHA512
1febe2d5500cb6babc51512708f4287ebb0958e59a5ec15b453b040bffbb563a2ee554806e55c7361fa45f871f15acd769ff94f1932727d4596b0de6d8da40e0
-
SSDEEP
24576:h1OYdaObCZ/iWCvu/2sWsJA/jlt+DHhs7:h1OsFCpYO/dJJDHhs7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CmeuOWNgsmpxPTc.exepid process 1952 CmeuOWNgsmpxPTc.exe -
Loads dropped DLL 1 IoCs
Processes:
c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exepid process 1592 c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
CmeuOWNgsmpxPTc.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdodilmfaihbfmpadcehamlbnpnklfnk\2.0\manifest.json CmeuOWNgsmpxPTc.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdodilmfaihbfmpadcehamlbnpnklfnk\2.0\manifest.json CmeuOWNgsmpxPTc.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdodilmfaihbfmpadcehamlbnpnklfnk\2.0\manifest.json CmeuOWNgsmpxPTc.exe -
Drops file in System32 directory 4 IoCs
Processes:
CmeuOWNgsmpxPTc.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy CmeuOWNgsmpxPTc.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini CmeuOWNgsmpxPTc.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol CmeuOWNgsmpxPTc.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI CmeuOWNgsmpxPTc.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
CmeuOWNgsmpxPTc.exepid process 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe 1952 CmeuOWNgsmpxPTc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
CmeuOWNgsmpxPTc.exedescription pid process Token: SeDebugPrivilege 1952 CmeuOWNgsmpxPTc.exe Token: SeDebugPrivilege 1952 CmeuOWNgsmpxPTc.exe Token: SeDebugPrivilege 1952 CmeuOWNgsmpxPTc.exe Token: SeDebugPrivilege 1952 CmeuOWNgsmpxPTc.exe Token: SeDebugPrivilege 1952 CmeuOWNgsmpxPTc.exe Token: SeDebugPrivilege 1952 CmeuOWNgsmpxPTc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exedescription pid process target process PID 1592 wrote to memory of 1952 1592 c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe CmeuOWNgsmpxPTc.exe PID 1592 wrote to memory of 1952 1592 c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe CmeuOWNgsmpxPTc.exe PID 1592 wrote to memory of 1952 1592 c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe CmeuOWNgsmpxPTc.exe PID 1592 wrote to memory of 1952 1592 c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe CmeuOWNgsmpxPTc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe"C:\Users\Admin\AppData\Local\Temp\c28b0c8fff487fc22ca149688360d253aafed428b91a40dcf7517255afa2548b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\CmeuOWNgsmpxPTc.exe.\CmeuOWNgsmpxPTc.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\CmeuOWNgsmpxPTc.datFilesize
1KB
MD5dc633af9b8e969b3cd1f2470972f95fc
SHA173e30e2dc51a0625280abc2148769f2bd8cd4dd6
SHA256b6b904afae66eea11c51c394c8143688e9ea98f67c8f8104457944ad5ca1c629
SHA512e801e3901b23b51781c4f626e9d9a7bf07b9dab89fdc7462dc6013d3999d99dd52ad5faf1b20a918184c13afbe2218933c10a01c0db504a4d7cbdf643d696934
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\CmeuOWNgsmpxPTc.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\DhMakFp@j.edu\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\DhMakFp@j.edu\chrome.manifestFilesize
35B
MD5f199e03bfeff6bfbea504b48bdeeeb89
SHA133397c70c539ff1ffe404848fa994de8b4b5740e
SHA25647c72e74424aaf5fcc9bc8d1c0934ba2190a1027ed0817f644934c6f9730b275
SHA51216022856d6145a085edc7f21e64f3e20ec17b1d047741e5091e12553cd26b1d562c7dfecdee66e08a1cf6ff139bb98feb77a1047ef09af1f2f66527a045fe665
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\DhMakFp@j.edu\content\bg.jsFilesize
8KB
MD567fe00808ad4a860f238ccecf7697a65
SHA136eb2cc5d709cf272d0c8efb18c7ba4b637c55e6
SHA2562128252fde98d9c6492003e4c645e545c4075b4db8d752f41f26cbbe42ce6467
SHA51284c32f5e4655fdd32db6feff74d5960204eae4ba2fa1efe30e463157abc47252a940c08ceb84fa53c20ef6ec0af9d1747a56bcba2c23c6fda81eb116a7170480
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\DhMakFp@j.edu\install.rdfFilesize
595B
MD5680d3fc6b01f9f46a773bcce5cda587c
SHA135ae949922a1c2737e0b4368f6ca5ecd5f00d29b
SHA2567ea15332ecaa381f13e2995dfa45d74a2c681d37ded55d602c33642faa4b1641
SHA512ae085c567daf1d40d8a7e3c503e8e202c10e37f39a0432eaa9a8fb4643f36a961c3fc2c31f9cb0f0f2bcdec3803a53bf326ba90dc3297efbe031fcaf35dc6f91
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\mdodilmfaihbfmpadcehamlbnpnklfnk\XcS.jsFilesize
6KB
MD5ff3a47acc2b1177c1d8dce9af8f50946
SHA13816415554269804b4380489b97f2a5dc4a858d9
SHA256bb819214337f1ccc8d528c8b19d99b9dcd1d5f328a11cdc3b5fc7604250294bd
SHA512afc33f9a234c7446a974db499b87c95c69cfe2aab1f76e4deed40c4bb3de3e6d386d6d7971aa49f00858e1fce7f1bd875fd671f6bb4035e720425960c93aee73
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\mdodilmfaihbfmpadcehamlbnpnklfnk\background.htmlFilesize
140B
MD5874217921652cf242f5fce7d63e4c7bc
SHA13a01f045173c183c5d0602e4995dc89a7e2f0825
SHA25618d40fcbd934bd45cd095c111f1600ce24e156c2506661bcc2392f039f2eceb7
SHA512ea0129414224813c14957dc2815ed1afb9fa3f73a2c6d07f651aaa399785454678066df08d0f5ed338d2e659583518f2a36f5acd8d874f86839656ab32edca63
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\mdodilmfaihbfmpadcehamlbnpnklfnk\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\mdodilmfaihbfmpadcehamlbnpnklfnk\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\mdodilmfaihbfmpadcehamlbnpnklfnk\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zS4EDC.tmp\CmeuOWNgsmpxPTc.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1592-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1952-56-0x0000000000000000-mapping.dmp