Analysis
-
max time kernel
57s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe
Resource
win7-20221111-en
General
-
Target
c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe
-
Size
919KB
-
MD5
fd6c91c19dd5565ddf9223e74dfbebff
-
SHA1
0c2f84b59115b08930a74d545958ae972f12e3f8
-
SHA256
c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad
-
SHA512
5030b5f7223f16dc90ccf3a0ebc6f21075a86b55fdefddcef9abf7b4d6cdbe1e133a004ab28fb24026b18379be46b127aac4b3049593ab88d1d72184ee0ee310
-
SSDEEP
24576:h1OYdaOLMtdHAqcdDVhYwiei7+EpFAh/kKy:h1OsCPHVmVhYwiLtKkKy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hhECqWZ1G9fJxhr.exepid process 2020 hhECqWZ1G9fJxhr.exe -
Loads dropped DLL 1 IoCs
Processes:
c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exepid process 1108 c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
hhECqWZ1G9fJxhr.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lakfapnoemognbmalidddnnnigaofekf\2.0\manifest.json hhECqWZ1G9fJxhr.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lakfapnoemognbmalidddnnnigaofekf\2.0\manifest.json hhECqWZ1G9fJxhr.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lakfapnoemognbmalidddnnnigaofekf\2.0\manifest.json hhECqWZ1G9fJxhr.exe -
Drops file in System32 directory 4 IoCs
Processes:
hhECqWZ1G9fJxhr.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy hhECqWZ1G9fJxhr.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini hhECqWZ1G9fJxhr.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol hhECqWZ1G9fJxhr.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI hhECqWZ1G9fJxhr.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
hhECqWZ1G9fJxhr.exepid process 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe 2020 hhECqWZ1G9fJxhr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
hhECqWZ1G9fJxhr.exedescription pid process Token: SeDebugPrivilege 2020 hhECqWZ1G9fJxhr.exe Token: SeDebugPrivilege 2020 hhECqWZ1G9fJxhr.exe Token: SeDebugPrivilege 2020 hhECqWZ1G9fJxhr.exe Token: SeDebugPrivilege 2020 hhECqWZ1G9fJxhr.exe Token: SeDebugPrivilege 2020 hhECqWZ1G9fJxhr.exe Token: SeDebugPrivilege 2020 hhECqWZ1G9fJxhr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exedescription pid process target process PID 1108 wrote to memory of 2020 1108 c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe hhECqWZ1G9fJxhr.exe PID 1108 wrote to memory of 2020 1108 c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe hhECqWZ1G9fJxhr.exe PID 1108 wrote to memory of 2020 1108 c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe hhECqWZ1G9fJxhr.exe PID 1108 wrote to memory of 2020 1108 c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe hhECqWZ1G9fJxhr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe"C:\Users\Admin\AppData\Local\Temp\c20624bce48c4b0f9ed8cff8d51fcd3017ae53e42eef682dcfbe8f63ff8fbfad.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\hhECqWZ1G9fJxhr.exe.\hhECqWZ1G9fJxhr.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\U1g@bcmh0ng.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\U1g@bcmh0ng.net\chrome.manifestFilesize
35B
MD503da50f002cf1192f812060f8fd647fb
SHA10c35f24f694caec622c1d35aa5827b464ce7cf41
SHA256da6c5c9570d768ce2beca2c8052de86fe85b7b331a0dc6c7822aff51fcb92e39
SHA51247326b47f332fdada5d4ee5f7c0cc5ef11c394515605342d38735b843363ac5a0e4b304ea3d883e628a115179aa2e7873388d0eeeef46413c8499557377a53ab
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\U1g@bcmh0ng.net\content\bg.jsFilesize
8KB
MD507744fe9f80e4dccec43d28a87f356e2
SHA1ef6b8735bd066513ea44215e52fd8637b8f05ed4
SHA25601dee96563ac00bd33f4600ffe332524e77878c5ff1bf9daed698c186eb8f0db
SHA512d8537f8fecc4f65f060dec732af71aba28a687924a717e3983aebfd9b3e1ca417d293bca6d7af238d706f36c8a18e547e67324ff7737324b5162b05f98c4525f
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\U1g@bcmh0ng.net\install.rdfFilesize
598B
MD587781de6af89323754059a30d9adabbe
SHA18a731a6c870729ef78eb382d35bba2d63e90f7ae
SHA256e624b4fd48a046eb6e18dc1abbe336b225e31e23f039cf47d66c22287d7b50da
SHA5122f206e415a89f02c9560327e7a01964821bd6f4b5f4292fd7cbd0c3e801f9bdf109ad690f5877975ddc20a5a397ae98c1020505cdfa066b7c2cc3cd842218c62
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\hhECqWZ1G9fJxhr.datFilesize
1KB
MD5b1e0649773830d4dc46b471ed226b3ee
SHA156cfc01f1261737a1209ebc6e8ac6ae9b60966a0
SHA256ebe919bfdb79715cbc070f1d4cb0d8aaff134917711baed78fff898582b2e086
SHA51229520d30a42850188a17182cd41613596ea231bab2f4f9bbe6f8ea35ca4a8999a71726cf8e0032872fbac3a3fc19944430b6c4facc8cfdc4356aff40ed295b6a
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\hhECqWZ1G9fJxhr.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\lakfapnoemognbmalidddnnnigaofekf\background.htmlFilesize
139B
MD5e930e0d9a711c1a24a757b001625740b
SHA14103ed45e3a5c1a169137bd82e80f3de2176724f
SHA25619ce2dbb507e301294e94b9bf35bc37e41623debd3fa550b6db8918b0e0fd68c
SHA51281be280fd2e1f13b845365082d1c76a3f57ee880396736635e3e89fed0132d6c20e15cfd15c421ea8b43e09902e3cdbda54b74a2452b3470496f4dde3005beb8
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\lakfapnoemognbmalidddnnnigaofekf\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\lakfapnoemognbmalidddnnnigaofekf\j2.jsFilesize
6KB
MD53f95a910187f2df69c503732f998f55d
SHA1348596c4d40eea27ecac02277e09c8c2c9421984
SHA256e9a821a9ec81e616b8215d298ee31411ec987c9cdf4fd9f6243f3e336732757d
SHA512dcc177f9406c0b03d439ea95a2b6a2e1715299e0731dec36deeda786808fe00da741ea8ed9d6496751fbe5f2638e073c58c3b57642f1eb8b2249fccbeba2de0f
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\lakfapnoemognbmalidddnnnigaofekf\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\lakfapnoemognbmalidddnnnigaofekf\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zS3D21.tmp\hhECqWZ1G9fJxhr.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1108-54-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/2020-56-0x0000000000000000-mapping.dmp