c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf

Analysis

max time kernel
36s
max time network
80s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe
Size

932KB
MD5

4a08d146a79c5313dd96b788a776339d
SHA1

a69db8af1e70100142dc3d1c5cdc190f5bb85f7b
SHA256

c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf
SHA512

cfbce459cdb07d5192ed3f8bc4585331d20f01485e99c087d166b0e739091cafbcbc4b67efd6e6f9bdf42501fa948e418f513ca5b31cd9773b241427166e28d8
SSDEEP

24576:h1OYdaO6CZ/iWCvu/2sWsJA/jlt+DHhst:h1OsECpYO/dJJDHhst

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ypTTw5O9bpiTbhU.exe

pid process

1956 ypTTw5O9bpiTbhU.exe
Loads dropped DLL 1 IoCs

Processes:

c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe

pid process

1972 c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1972	c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe

Drops Chrome extension 3 IoCs

Processes:

ypTTw5O9bpiTbhU.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkkgddckohccdagmplnkknakkeokljhg\2.0\manifest.json	ypTTw5O9bpiTbhU.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkkgddckohccdagmplnkknakkeokljhg\2.0\manifest.json	ypTTw5O9bpiTbhU.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkkgddckohccdagmplnkknakkeokljhg\2.0\manifest.json	ypTTw5O9bpiTbhU.exe

Drops file in System32 directory 4 IoCs

Processes:

ypTTw5O9bpiTbhU.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	ypTTw5O9bpiTbhU.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ypTTw5O9bpiTbhU.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ypTTw5O9bpiTbhU.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ypTTw5O9bpiTbhU.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

ypTTw5O9bpiTbhU.exe

pid	process
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe
1956	ypTTw5O9bpiTbhU.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ypTTw5O9bpiTbhU.exe

description	pid	process
Token: SeDebugPrivilege	1956	ypTTw5O9bpiTbhU.exe
Token: SeDebugPrivilege	1956	ypTTw5O9bpiTbhU.exe
Token: SeDebugPrivilege	1956	ypTTw5O9bpiTbhU.exe
Token: SeDebugPrivilege	1956	ypTTw5O9bpiTbhU.exe
Token: SeDebugPrivilege	1956	ypTTw5O9bpiTbhU.exe
Token: SeDebugPrivilege	1956	ypTTw5O9bpiTbhU.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe

description	pid	process	target process
PID 1972 wrote to memory of 1956	1972	c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe	ypTTw5O9bpiTbhU.exe
PID 1972 wrote to memory of 1956	1972	c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe	ypTTw5O9bpiTbhU.exe
PID 1972 wrote to memory of 1956	1972	c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe	ypTTw5O9bpiTbhU.exe
PID 1972 wrote to memory of 1956	1972	c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe	ypTTw5O9bpiTbhU.exe

C:\Users\Admin\AppData\Local\Temp\c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe
"C:\Users\Admin\AppData\Local\Temp\c1a68e5503d5369499e01a75b2523ce48994a5b087cd5aea36df0175c14a61cf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\ypTTw5O9bpiTbhU.exe
.\ypTTw5O9bpiTbhU.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\FcL@c.com\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\FcL@c.com\chrome.manifest
Filesize
35B

MD5
63b2213b003565b14e04573bcd5fe83b

SHA1
3345d46dd66cea60ebf7d377ba13896ea6d73f00

SHA256
db9fdd5109dbe94241798036bce5175f703e842403f875433e1d4e88e7ab47a4

SHA512
5efcdf455536c6109b50c53d434b2a72c49d6425233d2be615b3735f6cda134b6e4d563fd7a84db6ada180152512eb9ad11ddbec9cbe61525460c262ffcd1bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\FcL@c.com\content\bg.js
Filesize
9KB

MD5
965b31c0ba57c77d015fe9c4989b5cfc

SHA1
a46b00bf07d16053e640bdbbd6a447a17262b67f

SHA256
bb2bf3ccfb30948f9f927f15f203bf970c1b3f7a8349a721b5359174b89970e0

SHA512
cf4e8dc9a942e9cfe382cca4cd1c2e51f749c0c2cdbfee9324cd1c1ee0add61008330ea14731a23c75610fd7ec02c053dc3ab5498bea6eb389cb41b3b9dbf944

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\FcL@c.com\install.rdf
Filesize
591B

MD5
a78992ac9f0fdb3ad3d9360c63bc6f9e

SHA1
2aba76ab716284a62b7c40a939b462553aae503d

SHA256
0f6dce2e633cfbba11de8eb735133ad47c933880a056310bcc1d82c88cffd821

SHA512
0e5fae7541fdc7cf26eb3e5bb2dfd126811dc3e1c62ef3d39dec5eaeb552ce6fd2388ea0785a973af51963eaa835196206bc6c6999ac1a0eb8570c811f00617a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\hkkgddckohccdagmplnkknakkeokljhg\background.html
Filesize
144B

MD5
5db56d86fe437cb3ec95b8ae3030df23

SHA1
41b2348ddc0457bf640870f9196d1d4566965ed7

SHA256
78f403794743858c1c3697574a6b25a566dd7639f1f9391599430bb0fc04f4e5

SHA512
8c89f9d0793b25e3c9722d124c47577471cdf1cbf7bdb4240278ba5f2feb1134ecef68e05573a3f4acc0cb0b836953ccc4a27d864c1fce8ee3d636b35c07b530

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\hkkgddckohccdagmplnkknakkeokljhg\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\hkkgddckohccdagmplnkknakkeokljhg\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\hkkgddckohccdagmplnkknakkeokljhg\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\hkkgddckohccdagmplnkknakkeokljhg\oP2hWy7.js
Filesize
6KB

MD5
e349574d0dfe0ccf2b6a255bd7ec8c6e

SHA1
5d330d70c865d550ac410d53471142fd513a4eba

SHA256
71cf45277e17b86bd9fb311c97277e287275a4ff2a47bc8bd98f61d3f4cb7cda

SHA512
ca012eabb7bbfda9eab1f39edc5a7a109344ca5c32925075d4b90e437914030882223f558896c196b887bde4dbfe3eb54c0d15f7c0c075925be6100c1ab33f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\ypTTw5O9bpiTbhU.dat
Filesize
1KB

MD5
25e8862691433e169572bd2e66086d9b

SHA1
df6a98865a700fc85c83cc5443398172b64531ef

SHA256
6dc9d05d719ca019cbce5dd56f42bca1f00167427667bb9fdf69651509cc0f5a

SHA512
f786e7181ba76a782339d020a980751b3f78c446efdf13b39eccf046011e5c48f51d2efaf2bc3ac7fc942ab0ec05998c6ea991b30b3846be050c851eff9c8ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\ypTTw5O9bpiTbhU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
\Users\Admin\AppData\Local\Temp\7zS9F8B.tmp\ypTTw5O9bpiTbhU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1956-56-0x0000000000000000-mapping.dmp

Download
memory/1972-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads