c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe

Analysis

max time kernel
246s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe
Size

932KB
MD5

930bf062fe79cc8b6b4ecbb070fa3107
SHA1

6d0b27dbd2935c6b3025062e70238b25c5643e6c
SHA256

c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe
SHA512

a8fdf562d68ebf24d8e7488cf384c330ef65bac3c47441ad23c14dbc8a6d7e414d2a9a7fca11326d11c41d6da42948a3bd45c23de909fe8006a30951f119a9b0
SSDEEP

24576:h1OYdaO5CZ/iWCvu/2sWsJA/jlt+DHhsL:h1OsfCpYO/dJJDHhsL

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vDuyhDVJiIdvIL2.exe

pid process

1896 vDuyhDVJiIdvIL2.exe
Loads dropped DLL 1 IoCs

Processes:

c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe

pid process

520 c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
520	c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe

Drops Chrome extension 3 IoCs

Processes:

vDuyhDVJiIdvIL2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikplcpbcfaphejpoheddnkoijaciojd\2.0\manifest.json	vDuyhDVJiIdvIL2.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikplcpbcfaphejpoheddnkoijaciojd\2.0\manifest.json	vDuyhDVJiIdvIL2.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikplcpbcfaphejpoheddnkoijaciojd\2.0\manifest.json	vDuyhDVJiIdvIL2.exe

Drops file in System32 directory 4 IoCs

Processes:

vDuyhDVJiIdvIL2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	vDuyhDVJiIdvIL2.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	vDuyhDVJiIdvIL2.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	vDuyhDVJiIdvIL2.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	vDuyhDVJiIdvIL2.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

vDuyhDVJiIdvIL2.exe

pid	process
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe
1896	vDuyhDVJiIdvIL2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

vDuyhDVJiIdvIL2.exe

description	pid	process
Token: SeDebugPrivilege	1896	vDuyhDVJiIdvIL2.exe
Token: SeDebugPrivilege	1896	vDuyhDVJiIdvIL2.exe
Token: SeDebugPrivilege	1896	vDuyhDVJiIdvIL2.exe
Token: SeDebugPrivilege	1896	vDuyhDVJiIdvIL2.exe
Token: SeDebugPrivilege	1896	vDuyhDVJiIdvIL2.exe
Token: SeDebugPrivilege	1896	vDuyhDVJiIdvIL2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe

description	pid	process	target process
PID 520 wrote to memory of 1896	520	c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe	vDuyhDVJiIdvIL2.exe
PID 520 wrote to memory of 1896	520	c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe	vDuyhDVJiIdvIL2.exe
PID 520 wrote to memory of 1896	520	c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe	vDuyhDVJiIdvIL2.exe
PID 520 wrote to memory of 1896	520	c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe	vDuyhDVJiIdvIL2.exe

C:\Users\Admin\AppData\Local\Temp\c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe
"C:\Users\Admin\AppData\Local\Temp\c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:520

C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\vDuyhDVJiIdvIL2.exe
.\vDuyhDVJiIdvIL2.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\nikplcpbcfaphejpoheddnkoijaciojd\DtHdpR.js
Filesize
6KB

MD5
7380121fcf64d4443480832a6fc0d2d4

SHA1
5e10678ccf9f5e495e822bf141535d6a25e69108

SHA256
a9715e0b00f0e9c78187ebd67f2ee6f6e228cfde9becb5b6d71b1ec301c953e3

SHA512
627712e13dfae65c6fb3b63a71a7500616804fb26a210dca7b96768fd279434aab41a18912361c79fe7a3ddcb667d42562cf45828c422fe01a977e7c8b745d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\nikplcpbcfaphejpoheddnkoijaciojd\background.html
Filesize
143B

MD5
a5627db7938df1aa83d2430ae7a4f461

SHA1
a6c590ffb9e9d67614217ec13fd02fdefcd26edd

SHA256
e9d506d1a31398636ba295bad978c37a48e4cd80cc0a99eb50a5eb0d03d3eacc

SHA512
525b03feae20e5ac684c5e4791c087278c67607232b75cfb1e346ddc813567124c297b4225cceec32bf6106677c9ef1950a509beb93034c8062c8920b7219ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\nikplcpbcfaphejpoheddnkoijaciojd\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\nikplcpbcfaphejpoheddnkoijaciojd\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\nikplcpbcfaphejpoheddnkoijaciojd\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\npmO@tP.org\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\npmO@tP.org\chrome.manifest
Filesize
35B

MD5
7011468a5e5fd8142ecad7ac57c86e71

SHA1
32ca8dacb1a479e51f19cb79c6a18154d298ec5b

SHA256
cf8adae3ec58604344c27b198d82b85fb2a513251088d2d18ba850ae8df22d35

SHA512
ffa26325dfcbe140fb994aeb72d6fa54fd95f22208305f1acacc4f508301ec259123ebd047b31dce47bdd03beb0c55ec758fad346343ee4b96a99c915a54a746

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\npmO@tP.org\content\bg.js
Filesize
8KB

MD5
9330c755d9265662c9bdc03ce07ee4a9

SHA1
7dc1f757893d0b8db10b030a1a85653722a988fe

SHA256
a5294eb2611b6522d8463c62fa7b1b62103c16e1d43110d1dde21aee45a94273

SHA512
bb5f992f0f2cf0eb89c4995ec913fed8c2ffe809e90e77402acc160d64ebf9fe169bdd850486d28965776b8a7aae2f8011b1fec867ed6a627d29d6989f74c5e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\npmO@tP.org\install.rdf
Filesize
593B

MD5
86569f0542bd2e1b318c1260fbbdc415

SHA1
1b7d363ac4770e7437cac9a374396702717acb19

SHA256
6b44b8ab7a131dc37cc3770c0ed40b679142b2778ec8eb74ae408fe62dcb07d9

SHA512
8aa45204d4eda4158a4dbe95a18ea659089f18ad9d13052056fb3249112918e80977050369d883b95a6bcd1de461cda3d7b130bc90056e06ea4cc307b003552d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\vDuyhDVJiIdvIL2.dat
Filesize
1KB

MD5
8b6d93965677aede267828b0bf0a4b49

SHA1
ee998edc61e80b22794df3796bbeb824cb0709e8

SHA256
14c1fd33e0e04f66f16148932658ca4b0fcdea559e8f6d6f6b41e5442448069d

SHA512
76648a9f7dc0fc5ddef3e9149bcf255060e44c14082c06d727febd67656f4644be04bdfbb84f4b16db778c62e9d1001f284887704635ce67b233f79557702b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\vDuyhDVJiIdvIL2.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
\Users\Admin\AppData\Local\Temp\7zSDA68.tmp\vDuyhDVJiIdvIL2.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/520-54-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/1896-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads