Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:42
Static task
static1
Behavioral task
behavioral1
Sample
c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe
Resource
win7-20221111-en
General
-
Target
c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe
-
Size
920KB
-
MD5
7552e61325fef1e8d236e5daa14ce389
-
SHA1
bd00644ef1cd1dafc3e79e7f9421842df551a0e2
-
SHA256
c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12
-
SHA512
e518e0eedba257171c13f33c15065b17546c314146e144a4d5fc0d09c86863764329ff719896d4195a88ac925d83bdb79944714c64892b6aa45a814b28543cb5
-
SSDEEP
24576:h1OYdaOBMtdHAqcdDVhYwiei7+EpFAh/kKf:h1OsYPHVmVhYwiLtKkKf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
RZxJvTTpU2VR5cI.exepid process 1624 RZxJvTTpU2VR5cI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
RZxJvTTpU2VR5cI.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dciijjoaiclnebolfhdkhpfmfhmpglhc\2.0\manifest.json RZxJvTTpU2VR5cI.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dciijjoaiclnebolfhdkhpfmfhmpglhc\2.0\manifest.json RZxJvTTpU2VR5cI.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dciijjoaiclnebolfhdkhpfmfhmpglhc\2.0\manifest.json RZxJvTTpU2VR5cI.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dciijjoaiclnebolfhdkhpfmfhmpglhc\2.0\manifest.json RZxJvTTpU2VR5cI.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dciijjoaiclnebolfhdkhpfmfhmpglhc\2.0\manifest.json RZxJvTTpU2VR5cI.exe -
Drops file in System32 directory 4 IoCs
Processes:
RZxJvTTpU2VR5cI.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy RZxJvTTpU2VR5cI.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini RZxJvTTpU2VR5cI.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol RZxJvTTpU2VR5cI.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI RZxJvTTpU2VR5cI.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
RZxJvTTpU2VR5cI.exepid process 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe 1624 RZxJvTTpU2VR5cI.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RZxJvTTpU2VR5cI.exedescription pid process Token: SeDebugPrivilege 1624 RZxJvTTpU2VR5cI.exe Token: SeDebugPrivilege 1624 RZxJvTTpU2VR5cI.exe Token: SeDebugPrivilege 1624 RZxJvTTpU2VR5cI.exe Token: SeDebugPrivilege 1624 RZxJvTTpU2VR5cI.exe Token: SeDebugPrivilege 1624 RZxJvTTpU2VR5cI.exe Token: SeDebugPrivilege 1624 RZxJvTTpU2VR5cI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exedescription pid process target process PID 4572 wrote to memory of 1624 4572 c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe RZxJvTTpU2VR5cI.exe PID 4572 wrote to memory of 1624 4572 c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe RZxJvTTpU2VR5cI.exe PID 4572 wrote to memory of 1624 4572 c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe RZxJvTTpU2VR5cI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe"C:\Users\Admin\AppData\Local\Temp\c276ab28cdaf7c185cea21ef5020d159caf184d7cfd4d65fe24bdd9b320ecf12.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\RZxJvTTpU2VR5cI.exe.\RZxJvTTpU2VR5cI.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\0pO@3.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\0pO@3.com\chrome.manifestFilesize
35B
MD587daf2e24d530252bf4f6131ceefd31c
SHA13d7a82a276fa8e65b3f5ef45df0554d01fea6ab7
SHA2567e51d0f230ee5f0294aa0b64b050f77cadce4d8ac95dcb11345e1f37016839c2
SHA5122bff0ed69ca1ba3f10d3728669233fcb0b317ad2c5aab93b7212568aa6ed9383204adea92282d2f1da60a314417b192230b6a1f402b4c767d49db680fedf67a8
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\0pO@3.com\content\bg.jsFilesize
8KB
MD5ccfa0789a802b8e496a406fd91d601f4
SHA166710a14f48f1408c103f504d7b2271802700099
SHA25682d949848f2786959796b7337c8b2cbd9b21f5e7a236d592a328129b2df3799e
SHA512bb47ef5b18dc1dc87279d5ee0d51d51f8b2b1d113fe38f9eb8baf36f70e9e2080f0ddaef8d6773c68a4a596be871311de9c9bfca8719baf047c3380e769e2699
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\0pO@3.com\install.rdfFilesize
591B
MD5722d1f9a14c9488e7640b2076aa7a7ca
SHA1452c06a43b0166e2c9633cff61818da3686017a7
SHA256611d42269814cf6934ea7152ee87b1e907491175317a3900445fa2db25f53e06
SHA512d80618063478abec8acb707bc277ab4259e6ca8ca28899ea87067af7e14414e699ac1556defe6893ae5aa1756fc7054e40294d76e0d5a30c88bdbe4ce1c8ea87
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\RZxJvTTpU2VR5cI.datFilesize
1KB
MD56d3882a1b7cf6fda39ba34a01a02aa39
SHA194d2237892edfa7186d6d48c4385b975ebf1e729
SHA256acd46054cc5020ac94002175d5357a7e1552ae712bf6abc4c08dffeb47677bc2
SHA51295bdfb2445ac4d6427878a9d5506fe93e3923d9b1b2577cd0ee7afea15b4b975dfb9f34577e681293cdaafc97e6f0e2a481dab5e3788fb6bcfb642c0007b7e6a
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\RZxJvTTpU2VR5cI.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\RZxJvTTpU2VR5cI.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\dciijjoaiclnebolfhdkhpfmfhmpglhc\bVRLCHSb.jsFilesize
6KB
MD59014741c02fb8b5261996dead3b916d4
SHA18c38cdab93300c2034d0260bc61a7bd416d0e367
SHA256a72a2628494e41b52477316b60578675783b7cd17d18242c0b16a3a8b474ef17
SHA512382225517b0c549a8315f9ea9f15ffbe79feea82dab4a1da3fe1f9f1c88f32cab20534f4a391e7519c2280d298b91004dd5ca4e44e8fcd1a479b78e5f4e64a97
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\dciijjoaiclnebolfhdkhpfmfhmpglhc\background.htmlFilesize
145B
MD58ab236087c81a5f218c0673de5a1c60a
SHA19fe0f4c56cbb6c42a579ee26a577934c5fc3ebdc
SHA256eaafc3466f5d433f7dea858ad930b04083a3a85ee5f9830af9e9c7b7635e5157
SHA51290f3a1a8299c12e1a1d4859035c7cdf1d3d59fc9f6b02f8109e8fe853165ca5790dc87b5d05576bae4c03b323470234491c9f4c9eef19d3d0635c0a4d5cc3a4a
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\dciijjoaiclnebolfhdkhpfmfhmpglhc\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\dciijjoaiclnebolfhdkhpfmfhmpglhc\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSCE90.tmp\dciijjoaiclnebolfhdkhpfmfhmpglhc\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/1624-132-0x0000000000000000-mapping.dmp