c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d

Analysis

max time kernel
167s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe
Size

920KB
MD5

26148578412c00af19fa1ad9a79fe548
SHA1

852ccdca4bebb53ea6e07cc24a974309cd810b76
SHA256

c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d
SHA512

0d52fcd8c961caf5e657b70e25b6a38047d5b6c66bdaab9bc50e0a6a47d63f6fc2f80302063ae338a22f4846ca4a0d577c0709c46395cbb1470515c473db91b0
SSDEEP

24576:h1OYdaOxMtdHAqcdDVhYwiei7+EpFAh/kKZ:h1OsQPHVmVhYwiLtKkKZ

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

eqfFYoGr0NKgOJa.exe

pid process

1216 eqfFYoGr0NKgOJa.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

eqfFYoGr0NKgOJa.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json	eqfFYoGr0NKgOJa.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json	eqfFYoGr0NKgOJa.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json	eqfFYoGr0NKgOJa.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json	eqfFYoGr0NKgOJa.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\omcppbgjibmflhaijoihcemoakojbaoh\2.0\manifest.json	eqfFYoGr0NKgOJa.exe

Drops file in System32 directory 4 IoCs

Processes:

eqfFYoGr0NKgOJa.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	eqfFYoGr0NKgOJa.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	eqfFYoGr0NKgOJa.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	eqfFYoGr0NKgOJa.exe
File opened for modification	C:\Windows\System32\GroupPolicy	eqfFYoGr0NKgOJa.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

eqfFYoGr0NKgOJa.exe

pid	process
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe
1216	eqfFYoGr0NKgOJa.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

eqfFYoGr0NKgOJa.exe

description	pid	process
Token: SeDebugPrivilege	1216	eqfFYoGr0NKgOJa.exe
Token: SeDebugPrivilege	1216	eqfFYoGr0NKgOJa.exe
Token: SeDebugPrivilege	1216	eqfFYoGr0NKgOJa.exe
Token: SeDebugPrivilege	1216	eqfFYoGr0NKgOJa.exe
Token: SeDebugPrivilege	1216	eqfFYoGr0NKgOJa.exe
Token: SeDebugPrivilege	1216	eqfFYoGr0NKgOJa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe

description	pid	process	target process
PID 1536 wrote to memory of 1216	1536	c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe	eqfFYoGr0NKgOJa.exe
PID 1536 wrote to memory of 1216	1536	c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe	eqfFYoGr0NKgOJa.exe
PID 1536 wrote to memory of 1216	1536	c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe	eqfFYoGr0NKgOJa.exe

C:\Users\Admin\AppData\Local\Temp\c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe
"C:\Users\Admin\AppData\Local\Temp\c1dd19896191d3d26b6a0995c0aad8538951756b4794ced110740ec7931d0b4d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\eqfFYoGr0NKgOJa.exe
.\eqfFYoGr0NKgOJa.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\JH@v.edu\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\JH@v.edu\chrome.manifest
Filesize
35B

MD5
868058810ae01ee63cd4417f1a10f095

SHA1
550ec059f0490159523b7a2135acbd0e3b17704d

SHA256
184eec8dd6110e5fb0aa68894a7f873a2c5d0a7c650ac26060d899e8b0ccebb7

SHA512
3069019f453015bf275d79aaca41a52384f2698394abf2062df68d5ec8711d95be6cea138f3b34fa75ccfe3ffa55dbfdf2727b1271ede8e85b0259875786dee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\JH@v.edu\content\bg.js
Filesize
8KB

MD5
3ce743120504454d4c0306d4542de8e7

SHA1
98fbd3d0a3c6ba1ee484b960ab8e0fd3ceb29c81

SHA256
15666888e6fee28534b0a2719a56c67f6796a7fd76ff1485b2fa0e23573c0a9e

SHA512
764183cf8093bb63ead6dfa64a98ea7896f9e58b28fa2f3e7fcf0059ffc9d5e6342eb1ace9abe618d39b2b04edc10794acd0778f382a514bdb4a2cb9a7ba4369

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\JH@v.edu\install.rdf
Filesize
590B

MD5
7b7217e61dc4d897dee2c265981098f4

SHA1
abda438e6fb53c8473a5106f81c86ab5351ca006

SHA256
d1fd0d5225016d133d163e8c2b4cc5e575dd28fbfe99ca931945bdd7aab7544e

SHA512
3c3b6c260ee537bca928f9396098e15b24e966284a939bc7c6fb68221c6f77867f6faece9da5ba4b9b33cf6c3d74b73eda22247fff8cd3fb5ae1c82a6a509af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\eqfFYoGr0NKgOJa.dat
Filesize
1KB

MD5
a4929ce808284ce017878b61f3d35ce4

SHA1
ff03922edb0e74484ee58222a1cd91b215744e96

SHA256
62ee001ba524e017092747a3289ef242781835f5d6047b890e3380be2a284f29

SHA512
30e79984902a7fdc4cb11a4a47d280aadd9f54f89f0dd27506629fbb6671dc6642b2e43bf2d64e9ae99060a929f4eab7f6dede6b00ac419cfab6e18b4d1ca407

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\eqfFYoGr0NKgOJa.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\eqfFYoGr0NKgOJa.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\omcppbgjibmflhaijoihcemoakojbaoh\B.js
Filesize
6KB

MD5
ec470857e5505ab70ff300b42b23217b

SHA1
e4bd27022bae8519bf311673611daaa29f9345f6

SHA256
e80e5867dfa8ee6119ea99aceed77ee811654bb9d06e076d60ed59d6cd75c8fe

SHA512
f12283fd6e8ade68eb39eb4d327230f562de43afe84609b9cf3418f1a61e0ded31c094f2345679c6a841ed2acdd0b45d069d88f89f8fc32cba8ff78c20c71a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\omcppbgjibmflhaijoihcemoakojbaoh\background.html
Filesize
138B

MD5
ecc7692f5e5d2ac328b6585fbffef9bb

SHA1
05a55705ab0a85a481fab94ef4ab98745e0e54ae

SHA256
c46d8b1e0a0b08d8eeeec335402bfdec048efc95255c26cff2cd552453b77f09

SHA512
369956733c512f7174e7d51ee8f498f95b39dc3f4f8574f5c7a11ca8871f6b3855a7496d19d8d070b68f4f13e9bc745ba317ecabd92aea9b351db9957450f6de

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\omcppbgjibmflhaijoihcemoakojbaoh\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\omcppbgjibmflhaijoihcemoakojbaoh\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFE2B.tmp\omcppbgjibmflhaijoihcemoakojbaoh\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/1216-132-0x0000000000000000-mapping.dmp

Download