Analysis
-
max time kernel
4s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe
Resource
win7-20220812-en
General
-
Target
c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe
-
Size
2.5MB
-
MD5
ada6807a43e043df7fec76a2bbcdc54e
-
SHA1
11763f0cf8ea6ca268a9e95c65d2543d4aa55b64
-
SHA256
c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc
-
SHA512
e51eb143fa366758ed47a1e7b5d55788c5dbe9d3860dcb4ca228c9de626070d53b2440afb4f652e7bb0cf1fe18b82fbee6b06cc2740678522d67c6d1819a717a
-
SSDEEP
49152:h1OspjtPNg3MaK+715e2Yl8Wd7dZcRGzPbXO2mg6P1Ql5PPLKMRnUDO:h1OQjVNI71i86pZbz55PPLKMRUa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
0mhn4FhEShQpV1q.exepid process 956 0mhn4FhEShQpV1q.exe -
Loads dropped DLL 4 IoCs
Processes:
c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe0mhn4FhEShQpV1q.exeregsvr32.exeregsvr32.exepid process 996 c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe 956 0mhn4FhEShQpV1q.exe 1416 regsvr32.exe 896 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
0mhn4FhEShQpV1q.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpjlfglnonbkbobndgfddnhbgbmhkilp\2.0\manifest.json 0mhn4FhEShQpV1q.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpjlfglnonbkbobndgfddnhbgbmhkilp\2.0\manifest.json 0mhn4FhEShQpV1q.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpjlfglnonbkbobndgfddnhbgbmhkilp\2.0\manifest.json 0mhn4FhEShQpV1q.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
0mhn4FhEShQpV1q.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 0mhn4FhEShQpV1q.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 0mhn4FhEShQpV1q.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ 0mhn4FhEShQpV1q.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 0mhn4FhEShQpV1q.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 0mhn4FhEShQpV1q.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
0mhn4FhEShQpV1q.exedescription ioc process File created C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.dll 0mhn4FhEShQpV1q.exe File opened for modification C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.dll 0mhn4FhEShQpV1q.exe File created C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.tlb 0mhn4FhEShQpV1q.exe File opened for modification C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.tlb 0mhn4FhEShQpV1q.exe File created C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.dat 0mhn4FhEShQpV1q.exe File opened for modification C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.dat 0mhn4FhEShQpV1q.exe File created C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dll 0mhn4FhEShQpV1q.exe File opened for modification C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dll 0mhn4FhEShQpV1q.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0mhn4FhEShQpV1q.exepid process 956 0mhn4FhEShQpV1q.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe0mhn4FhEShQpV1q.exeregsvr32.exedescription pid process target process PID 996 wrote to memory of 956 996 c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe 0mhn4FhEShQpV1q.exe PID 996 wrote to memory of 956 996 c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe 0mhn4FhEShQpV1q.exe PID 996 wrote to memory of 956 996 c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe 0mhn4FhEShQpV1q.exe PID 996 wrote to memory of 956 996 c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe 0mhn4FhEShQpV1q.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 956 wrote to memory of 1416 956 0mhn4FhEShQpV1q.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 896 1416 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe"C:\Users\Admin\AppData\Local\Temp\c13b18cbb83b667987c737341a3c6cf632a44415f2bf4fac7e27288ea7e1c4cc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\0mhn4FhEShQpV1q.exe.\0mhn4FhEShQpV1q.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.datFilesize
6KB
MD59010ad249374a9bb216ebbca013310c4
SHA1a8314bdacd9e24a218dc314c8fe03ec2a0b22bcd
SHA2563b1bee2982aa8d1f7b778f1088c51c2fdf694a2339ddb640bb4c1604407583a9
SHA51200635cbf65e5660aeffb20f925594afc116675824d3abfc1cdf4a0b307b6156a6bbd4331ee5e1283ef5141da1a8c7a612a3d7e1f8302e3106462dba60ee942c6
-
C:\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\0mhn4FhEShQpV1q.datFilesize
6KB
MD59010ad249374a9bb216ebbca013310c4
SHA1a8314bdacd9e24a218dc314c8fe03ec2a0b22bcd
SHA2563b1bee2982aa8d1f7b778f1088c51c2fdf694a2339ddb640bb4c1604407583a9
SHA51200635cbf65e5660aeffb20f925594afc116675824d3abfc1cdf4a0b307b6156a6bbd4331ee5e1283ef5141da1a8c7a612a3d7e1f8302e3106462dba60ee942c6
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\0mhn4FhEShQpV1q.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\0mhn4FhEShQpV1q.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\1I2bDnd2DTFQy1.dllFilesize
741KB
MD502955857b45fa9ddd4229b9d67f65d93
SHA1a5fe5c71d62bd9648ab25660d7cae6eff98af3ed
SHA256839e59c1dd9fa6ce4ed8b4b964b32a3afdd5b6b621580c47cdad754868abe753
SHA5120b0c6a7754abead8aec777a1ee4330f4c5ee90aebde30266e6ad93f356f91abbe4a2bc3fdc924556edb82c3b4bd0f97191e72d6039bed14975d5e5b940af3261
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\1I2bDnd2DTFQy1.tlbFilesize
3KB
MD575846c93e1f5b9d77fcc4520a65b4936
SHA1f4631b5f768bfa33063a96c7a0da478c1fb28791
SHA256c6843974e37a7eb67c2e6550cec7ffd63645d80f4bd9613430e5824b4604b08b
SHA512a51876207191e351f955e614be727f9b0141cce69d46f7bbf141a632306fe277de3372848c5b707da525d22bafca044b0a73c544a2a670d4056d33f37f7b328c
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\1I2bDnd2DTFQy1.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\AZ@X.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\AZ@X.com\chrome.manifestFilesize
35B
MD5ba857b7a59bc0562358b01b59615b729
SHA172e55b34ca1c153d4702af2e5fd9bf02d4f1e2da
SHA256e2b8f6137c9dfa449927c79068f09e66f4be1d61c845e9ab158fb23b9894fed1
SHA512c30ca05d0f786ac14df5c4f4e890f5b587c1425a23419ab5f0375ed63d23edccaa2b3347f67cbbff8ea7bdb841838ce4695d967dd8afe09f04f716aa413ace41
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\AZ@X.com\content\bg.jsFilesize
7KB
MD5bb332aa0e7098f4b055b668131eba444
SHA123fd4fbe875b3b30a26c5d113c1ef5503384b38d
SHA2566b86aae764e77db3332b106bf06c4f90184f0d37b79026be7b8d71ec5f19506d
SHA5126946b3896bb7d972a9732ce064685bde41426ad561d06df54b63eb54642689978f7ea526c7483a06468aaccdc2a32a153ab6a688fa8b404537e968a13da95ca7
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\AZ@X.com\install.rdfFilesize
590B
MD58f7111c50453bced64663172be10b8e3
SHA13381114c0655cc4c7ab2d912d6a067ab71faf43a
SHA2567a409519a634515b2abfc76cb15a49d836e9373c8445f180478ca8f52d4dd483
SHA5122005c7ca9a38e7551d09e7cba5c62c7693726522bf80ac7830705d0654547df7510e728532ee575a26c214a0e2808efa16581079b0108bbd7364f3338cf678aa
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\fpjlfglnonbkbobndgfddnhbgbmhkilp\DXD.jsFilesize
5KB
MD53663cdfa55d5bb5296853705b6c33d21
SHA1fb7641d0f69164e079cc5436303eb1ef6a9d2a27
SHA2563801fd30f72b1d30c80a1eb06810a81d3bfa83e68c88b6f071774d0379a6eaf1
SHA5121953831d965a2f8488324aeedf9997b7c670554ea3631b5813030c2f0cfe1f055da073fe80d1b528d0c8d8140dec75e6314f5257434c65c3d15c8726f2d5a905
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\fpjlfglnonbkbobndgfddnhbgbmhkilp\background.htmlFilesize
140B
MD53fd7c1140fbb817710aa225a77ed4b67
SHA112c10a223611894f467e59cb3efc0af7f649a8fc
SHA256ed4dca6b4435c8be1d1954da95fbde2e30a735a1006e196db8a5ce1e89c8e47a
SHA51287030380adf8565318deb5b05e175f5bd248ee70205a66d1131859409254a636632265a84f8e5bedd37d9e64fb79f96ede0d6726df1983516f48308c502ad495
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\fpjlfglnonbkbobndgfddnhbgbmhkilp\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\fpjlfglnonbkbobndgfddnhbgbmhkilp\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\fpjlfglnonbkbobndgfddnhbgbmhkilp\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.dllFilesize
741KB
MD502955857b45fa9ddd4229b9d67f65d93
SHA1a5fe5c71d62bd9648ab25660d7cae6eff98af3ed
SHA256839e59c1dd9fa6ce4ed8b4b964b32a3afdd5b6b621580c47cdad754868abe753
SHA5120b0c6a7754abead8aec777a1ee4330f4c5ee90aebde30266e6ad93f356f91abbe4a2bc3fdc924556edb82c3b4bd0f97191e72d6039bed14975d5e5b940af3261
-
\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Program Files (x86)\GoSave\1I2bDnd2DTFQy1.x64.dllFilesize
879KB
MD5f60a9be9218f7d3c329205bd4f585ee7
SHA18b31e1d5b92ff6642cc5fb707ec76596ce84002c
SHA2567b08c02a0b7315c5b860b594d6486f85a8c182a1851313e1a6299810b896d394
SHA512a6a18d63220f92f80881aaf5f7ed936d7e317a50fe2fc0452f5b3c6793b5b6ffac782366c65d91d7cad1b5a68149f5fa9cd82cf57ba0208ea271c792bddee6a7
-
\Users\Admin\AppData\Local\Temp\7zSE85D.tmp\0mhn4FhEShQpV1q.exeFilesize
783KB
MD5e5f19b8f3fa9ba590482ee5d1c7ed005
SHA1e3d599ca32f07024e281f26e764ef09697aba822
SHA256688036044c4521a1841e9fb5a704d505bfc47c4fc80be111e9a321869a56f9b9
SHA512dde4cd947a2820da9a70c584ad136fc87bf68e272e3b5842967580165a602225fcb754966f2f5d3e66db87026c68f61055893b4d2033183ab5b35fe96d4e16ab
-
memory/896-77-0x0000000000000000-mapping.dmp
-
memory/896-78-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmpFilesize
8KB
-
memory/956-56-0x0000000000000000-mapping.dmp
-
memory/996-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1416-73-0x0000000000000000-mapping.dmp