Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe
Resource
win7-20221111-en
General
-
Target
c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe
-
Size
1.1MB
-
MD5
b0848b2a576fb1b98ce38dc743a8bc8f
-
SHA1
65bdfae6313b0d6a98eaafecbcd9f04f8433b426
-
SHA256
c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f
-
SHA512
a707822baf5807aee59612811e3dffff34d88e60cf79d10b6f8c1cff829c02117f380e03ea1adef86f5fb60e0f50c64492a72226c05b8f11ba6f371935c8654a
-
SSDEEP
24576:e1f8DA9Wt7vCyoDO7bcZEb93BA0/LtmWxn1YMSuh:eT9hyoC3yE/Ac5mWxnmch
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CBc6PhaAUEc3M1T.exepid process 1172 CBc6PhaAUEc3M1T.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
CBc6PhaAUEc3M1T.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ediifhionbebajbgpgmkgjiekncjjfcg\2.0\manifest.json CBc6PhaAUEc3M1T.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ediifhionbebajbgpgmkgjiekncjjfcg\2.0\manifest.json CBc6PhaAUEc3M1T.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ediifhionbebajbgpgmkgjiekncjjfcg\2.0\manifest.json CBc6PhaAUEc3M1T.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ediifhionbebajbgpgmkgjiekncjjfcg\2.0\manifest.json CBc6PhaAUEc3M1T.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ediifhionbebajbgpgmkgjiekncjjfcg\2.0\manifest.json CBc6PhaAUEc3M1T.exe -
Drops file in System32 directory 4 IoCs
Processes:
CBc6PhaAUEc3M1T.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol CBc6PhaAUEc3M1T.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI CBc6PhaAUEc3M1T.exe File opened for modification C:\Windows\System32\GroupPolicy CBc6PhaAUEc3M1T.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini CBc6PhaAUEc3M1T.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
CBc6PhaAUEc3M1T.exepid process 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe 1172 CBc6PhaAUEc3M1T.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exedescription pid process target process PID 3136 wrote to memory of 1172 3136 c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe CBc6PhaAUEc3M1T.exe PID 3136 wrote to memory of 1172 3136 c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe CBc6PhaAUEc3M1T.exe PID 3136 wrote to memory of 1172 3136 c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe CBc6PhaAUEc3M1T.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe"C:\Users\Admin\AppData\Local\Temp\c215e1d0dad1bf03b4652ad62d2dcab231b4b68a81780a32ac301e75e73ea79f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\210068bc\CBc6PhaAUEc3M1T.exe"C:\Users\Admin\AppData\Local\Temp/210068bc/CBc6PhaAUEc3M1T.exe"2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\210068bc\CBc6PhaAUEc3M1T.datFilesize
1KB
MD5eec5c10326e6ec44ecbf24c8291f847d
SHA1dbceff6c3542ad0ff77fb8165a1d716160dbf854
SHA256e56241d54234b08e65007d00cd5b436973933c47df4f9d87b52c4002a2179fb0
SHA512071945f1586f3014a5307b06a9d09629d11bfb5ff282d498b62ce62baeee2e6d2e0c95dbe92787921f8a4ea9e89ee7de7864aff7a2e9515bec0b9349efe61c85
-
C:\Users\Admin\AppData\Local\Temp\210068bc\CBc6PhaAUEc3M1T.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\210068bc\CBc6PhaAUEc3M1T.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\210068bc\ediifhionbebajbgpgmkgjiekncjjfcg\background.htmlFilesize
140B
MD5be5969975cf427cd7860805acde09a7e
SHA1aa3388a3539284ea7037750bb8e8a2821c6bbcd1
SHA25606ed699b5c95ea0f6c70dd3794b39e077f8db5ad4edce07cf33e713c0e21c239
SHA5126c59e8493748bbbd770803b90cea6a7c6d3164ff81a4dd398628173fd493d3a281f4bd32ee5e63363695a3ba28f37e42246fac7f6d0c40412d8a566724673e5f
-
C:\Users\Admin\AppData\Local\Temp\210068bc\ediifhionbebajbgpgmkgjiekncjjfcg\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\210068bc\ediifhionbebajbgpgmkgjiekncjjfcg\enW.jsFilesize
6KB
MD5d3ff97a890d12ace1a8236496afe3159
SHA18c0e6c5dadf244079ac4589fb3c759a808139250
SHA2565e46fb621d5a56ef066ccbbd4cef649ded8c5bfc48dac168cd77639f4c6aada0
SHA512ec3a6778fcc77e2456561876f2f6819ce5efbfacd7800c0322f4f3768e2621af5dc460f38a131ef0f3baeb7588ac414ea707f54300c9887f7e7e19c606ec32d5
-
C:\Users\Admin\AppData\Local\Temp\210068bc\ediifhionbebajbgpgmkgjiekncjjfcg\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\210068bc\ediifhionbebajbgpgmkgjiekncjjfcg\manifest.jsonFilesize
501B
MD505edf5ac117c006abc1847e8b5331f6c
SHA1e0f45e5897a8967ef33599b72e7fdf3beb72d239
SHA256b133bb8163ec7bb48118724f8d3e8eac8f9da6c579ac65a2b5aaa1b9653b6c18
SHA5129607b0c9c0add5c85403532aad754f8b51ecbb134b0a5e54bdcc26c8185eee26fff39ad420e905b9e014b5c2518949ca1f4a7c26ae987e3e4d0853aba2d878c9
-
C:\Users\Admin\AppData\Local\Temp\210068bc\wJe9@PeLhA.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\210068bc\wJe9@PeLhA.net\chrome.manifestFilesize
35B
MD508e40b6baf403b5cf45353fa88072105
SHA1a868a6b1ea5b409eb42b4849b6fcc8250ac67be7
SHA256493e4ca7d48cdf05a6eb13c7e86c57b988b36adc3bb8978a2b8e71ebc2b84815
SHA512d16dfaf0e140e778caf5ed4b884fe21b87f9a6e5fd1189080b29a215e319cb2a0a11a023914ec883f0f070ec1f72a58dbdec73550296b2053f5cbfb65bbfdcb5
-
C:\Users\Admin\AppData\Local\Temp\210068bc\wJe9@PeLhA.net\content\bg.jsFilesize
8KB
MD53971d74eaf8c265f72a6a5bfe036ebb4
SHA1dbf0f8119fc21d8f63964a61e302c63d9fc950c1
SHA25613a1da5d6da7753505542ed67b5873d88067685ec055abf15b0461e40371275e
SHA512cb98637b77144507ea3102dee5e1107a284802177ba97539b794da20000d37660afc300528d07280288302d3d4a700825bae202a79c49926e346c78f6bcd811a
-
C:\Users\Admin\AppData\Local\Temp\210068bc\wJe9@PeLhA.net\install.rdfFilesize
599B
MD586ab1100446a269afd7fa48de2055d8e
SHA1b317ff6efbb5d7829af291020d61e887f2f7f198
SHA25612ceab5a3d9f0347281e28f44ef57d056d766323aef1929a3ded04dbf1a4f2ab
SHA5121d48bb554ae80845ac6f015c1635c4017c188e87898602b159be372d252ff948b2e3663163813ed6a2e323fd83b62675ce515e89c3fb8961d3cc62f8f88c256a
-
memory/1172-132-0x0000000000000000-mapping.dmp