Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe
Resource
win7-20220812-en
General
-
Target
c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe
-
Size
931KB
-
MD5
bf900e6fa5f283951d75cb2b6fe53934
-
SHA1
0504b27ba9f88fc639ad4bfb7e5882c98257a730
-
SHA256
c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63
-
SHA512
e7763e061fb79f08f43f6a39cbdfaa0297443754b15108d6424c9455f811b7a29bcf19c1bee924a8c207781d754c5dc467ee4335789477766610736ea9e91f99
-
SSDEEP
24576:h1OYdaO0CZ/iWCvu/2sWsJA/jlt+DHhss:h1OsuCpYO/dJJDHhss
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
8maK67zd5YOzBmJ.exepid process 1080 8maK67zd5YOzBmJ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
8maK67zd5YOzBmJ.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojfgolfkgabachlmnmaokopieihjhmaa\1.3\manifest.json 8maK67zd5YOzBmJ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojfgolfkgabachlmnmaokopieihjhmaa\1.3\manifest.json 8maK67zd5YOzBmJ.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojfgolfkgabachlmnmaokopieihjhmaa\1.3\manifest.json 8maK67zd5YOzBmJ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojfgolfkgabachlmnmaokopieihjhmaa\1.3\manifest.json 8maK67zd5YOzBmJ.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojfgolfkgabachlmnmaokopieihjhmaa\1.3\manifest.json 8maK67zd5YOzBmJ.exe -
Drops file in System32 directory 4 IoCs
Processes:
8maK67zd5YOzBmJ.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 8maK67zd5YOzBmJ.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 8maK67zd5YOzBmJ.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 8maK67zd5YOzBmJ.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 8maK67zd5YOzBmJ.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8maK67zd5YOzBmJ.exepid process 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe 1080 8maK67zd5YOzBmJ.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exedescription pid process target process PID 3480 wrote to memory of 1080 3480 c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe 8maK67zd5YOzBmJ.exe PID 3480 wrote to memory of 1080 3480 c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe 8maK67zd5YOzBmJ.exe PID 3480 wrote to memory of 1080 3480 c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe 8maK67zd5YOzBmJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe"C:\Users\Admin\AppData\Local\Temp\c204c4f42c329ca9137b82ccde84c7efb32c2628f1f599d2bb4734edeb5d9d63.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\8maK67zd5YOzBmJ.exe.\8maK67zd5YOzBmJ.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\0@AONE4C.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\0@AONE4C.com\chrome.manifestFilesize
35B
MD550776b4dc1bfb8970371b27e5a2c5207
SHA19b0384ea19a538c1f1e22e6cac3888a0f7b3727d
SHA25614978f416589d8fcdbf74977af2dd91193949c8af0f2857b19183b556c2665fc
SHA51237332ce380137b726323bf854d716c87231e5721e7961548175e1ab6d271fe454c0546b28020af33cfa834c14d56604b74e6b6ac94936ebf12753780e462d3b8
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\0@AONE4C.com\content\bg.jsFilesize
8KB
MD59900790b272e1ab94c0f83835c9244a9
SHA1c5ead7aa820b341d847deeaebbbfd0ff3defbe74
SHA256bb2e99849981a72d68304fb75d75fedfa5b16350aba22742748917717c0a11bb
SHA512cea978a0a7cca067c6a292b690971144d3fe046f39d9424010cfada8f89362f5e6da666d2b34a77dcdb5f5efae60073ca3cd1b441204f44c430c4f7c77be5741
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\0@AONE4C.com\install.rdfFilesize
595B
MD590f29790c616e474c516f94eeb59e27f
SHA15103017690f0496bddd4d7ccccfe56759a555edd
SHA256b7bfff951f1cb672e388db5f3f984619e04c0edafffe5681fa6f057d5d0373eb
SHA5122f03694a2e119ed8e6a7e75e5f92ba22a18464b0df37dcb0dbaabfbb295c4fa9594937fafaf05ed26b65caf1dcb1239a6e4995dc8d74a553de0980263b015483
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\8maK67zd5YOzBmJ.datFilesize
1KB
MD5e87c241ed15bb160764b2d0a822464fa
SHA1f5f5408654a5b42f492705034017f327b7fe523e
SHA2560616c449f3b7d8cb527fe08b53390869e0e121d30a9af663658139db3fb5dd5c
SHA51273658227ef9374a6484ddbcbabce5dd853ad02d075c2b8a1e6371f5c0ac875dfc7f346d0c49a8e6778de3b35adeaea81b36a295f31fa2dea3812e40f6cac745d
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\8maK67zd5YOzBmJ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\8maK67zd5YOzBmJ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\ojfgolfkgabachlmnmaokopieihjhmaa\background.htmlFilesize
138B
MD57dd2b57ba885940b9df1fe2c6fd0a8e6
SHA14c44a1e3176b8104e2f970a4f0ef3a71f1a52f9e
SHA2569a1c766e378e3986665f74c961c3eb1a9c0071e4ba587d7d69284e6e545a96b6
SHA512c847e6f98a8b47e8a2058837f7e3d59b3fd71a2e1ac16ab2e427765a2104ef757b629cd0149d7f7c043627dbb17fb297441b9bee0ac496a4dc1c83e491aee053
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\ojfgolfkgabachlmnmaokopieihjhmaa\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\ojfgolfkgabachlmnmaokopieihjhmaa\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\ojfgolfkgabachlmnmaokopieihjhmaa\manifest.jsonFilesize
498B
MD5664e2884e17f23553a19eee317642194
SHA1a28ccc088d6b6692646150f3e8f111e568723fb4
SHA256ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191
SHA512b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb
-
C:\Users\Admin\AppData\Local\Temp\7zS8467.tmp\ojfgolfkgabachlmnmaokopieihjhmaa\r.jsFilesize
6KB
MD558da9721057c190bc3d341574981cdb9
SHA12f3f65863c299b9af90b691917c5e15e7f3294ce
SHA25610cf1719e4ca36ea9608da80119bab9aea9b241616f302c7698bf72d79cf0d87
SHA512c8aa2708159d09b5b3f7c8b66098602275265524aaf10086ae2a400fe891da263696c003b65bf9f909d1671d1817db08c5f56f632e0a8b6ad0ddff6aa994002d
-
memory/1080-132-0x0000000000000000-mapping.dmp