Analysis
-
max time kernel
3s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe
Resource
win7-20220812-en
General
-
Target
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe
-
Size
2.5MB
-
MD5
37dd51acc78742b396476ff38375aaba
-
SHA1
b37ca7082a493feb34153a0af29fe0c8dddbda30
-
SHA256
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38
-
SHA512
14bcde6883594595845aac170d46495efba7bb8fded8abab0514830eb8b428d5ecf80bf22568d26efa86c6632a962ff8e0a196befe0b5211b7250d910564f127
-
SSDEEP
49152:h1OslUc3R1YQeb1bR9qMS3te/+E+kzkeRutdQ3L3V/A9VeC:h1OgbRsTWe/Zo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
y1NgQaU2oTpoza7.exepid process 824 y1NgQaU2oTpoza7.exe -
Loads dropped DLL 4 IoCs
Processes:
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exey1NgQaU2oTpoza7.exeregsvr32.exeregsvr32.exepid process 1732 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe 824 y1NgQaU2oTpoza7.exe 2008 regsvr32.exe 1488 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
y1NgQaU2oTpoza7.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
y1NgQaU2oTpoza7.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} y1NgQaU2oTpoza7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} y1NgQaU2oTpoza7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects y1NgQaU2oTpoza7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} y1NgQaU2oTpoza7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ y1NgQaU2oTpoza7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
y1NgQaU2oTpoza7.exedescription ioc process File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dat y1NgQaU2oTpoza7.exe File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dll y1NgQaU2oTpoza7.exe File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dll y1NgQaU2oTpoza7.exe File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dll y1NgQaU2oTpoza7.exe File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dll y1NgQaU2oTpoza7.exe File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.tlb y1NgQaU2oTpoza7.exe File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.tlb y1NgQaU2oTpoza7.exe File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dat y1NgQaU2oTpoza7.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
y1NgQaU2oTpoza7.exepid process 824 y1NgQaU2oTpoza7.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exey1NgQaU2oTpoza7.exeregsvr32.exedescription pid process target process PID 1732 wrote to memory of 824 1732 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe PID 1732 wrote to memory of 824 1732 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe PID 1732 wrote to memory of 824 1732 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe PID 1732 wrote to memory of 824 1732 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 824 wrote to memory of 2008 824 y1NgQaU2oTpoza7.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 1488 2008 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe"C:\Users\Admin\AppData\Local\Temp\c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\y1NgQaU2oTpoza7.exe.\y1NgQaU2oTpoza7.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.datFilesize
6KB
MD5301127baa271d9dc6425520414e911c0
SHA150593df9dcdcffa4b1253e9a51367b3e7df8e225
SHA2563ae0c534e288628d9f50f5e8ed2a8d818a5fb54a0c6c55100b0dccae66f28dfc
SHA5126adf578e88042ba025c3e67f771e5ca51a6c912e43fe3ab1daaa8a8fcd6c507c898bfc8e24da840fabafc1b872530ce46da98fd95d3bc7bd9dfe247837250cdd
-
C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\0w@7.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\0w@7.net\chrome.manifestFilesize
35B
MD5918e9c780277b68cad882ec0dea1b422
SHA165089dbc8294fb74b1136977b6b704ff7fec6cd0
SHA25699db5e89bad0a55b24c8d76d51f2dcd3f4969f6691c8d8bb8594a857ee061e81
SHA512094c2a919793d62bcec50769d0cbbce4bc45f04d3031416da9ec3558032ef04e2904862737a701fe49eb0625a7e4a6c6f8e801bcbd41b6529e1ef80faf458ae2
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\0w@7.net\content\bg.jsFilesize
7KB
MD5fb38109c9b85e2d94d6ae8d825eddc8d
SHA15511f24cf7e52b40f1b480c95d9ca9c2268e243a
SHA256459fbf3ad6a4c750f08f2dbc6e7f82e1bab5ea88498e76778016ef72eeec3d63
SHA512d9aff020e199d77abb34dcd1f61587467840ca8b82006b984a94668a610201f015d31c090db8da0c44b013fd0a4564d3b521e6ffdc930f0ee45556fb3610b514
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\0w@7.net\install.rdfFilesize
597B
MD54f421c53a4969ec345df83ae6199860b
SHA1b2bdebf18585387d80bc7507358040224bdad890
SHA2561e145efc59a86858b1a25a81c9bf6a8b46f29392d1321d1381595b109fad78cd
SHA51214020e875cfb6d44ad6c357c8b21f4590918d2f4ee487bcf1b3413317e7c0b1d60ce41f659fd219ed617e8fe62ac062ff1dc053b408b4546af4708ec30aa4491
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\RSjxNRN5tJGNOK.dllFilesize
744KB
MD5fc8b2dfce95210e4fe59b69a454ce14a
SHA146acd69f9bc55784091a572c8aa4d4d153a874f8
SHA2563b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189
SHA5125ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\RSjxNRN5tJGNOK.tlbFilesize
3KB
MD5662093ad59715d81e0a2b7cfbd4ac684
SHA183419c0803aa1c25a27b1fb8ad4a663d2d4878b0
SHA25668fc930e26f7f38e30df8f8f40d1232b81af62d4cf27a281a8f645788ad1f6c4
SHA5120eaffb7f011f548e1c6f8490c3d353fa05976140383df85663b5ef13be110d4847f08afe236a796a7f10a28895d29a7344e6d346389aa0780cc24af50fd66bf6
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\RSjxNRN5tJGNOK.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\aaocmobhmglglhadegdjejcangmlkcbl\background.htmlFilesize
145B
MD51b19fb4cc57a7fa6e40c7f60a5ac3922
SHA1c46a0752d34cd498cfb1293f3917d277d7180807
SHA256bd6e13c2736b63e67fbed3a08281b73329840ca5291d8e475a104322c79b7da0
SHA512eed5ca8a8e019f95af4f43771e3b43e0e369df6d26c8001faadac03d0dfc6b9908f13ca31d85f051e1fbebeb97336a2d4a50f2aacfdfb08d4bdd863d166f4397
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\aaocmobhmglglhadegdjejcangmlkcbl\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\aaocmobhmglglhadegdjejcangmlkcbl\j47VSQbU.jsFilesize
5KB
MD5754468b9cd4c0cc1a64789ed28bdd1f0
SHA162d1ddb6f16b3cd85fd1e7ae29fd5844a090a504
SHA256a145c6cacd508ec080615f3bbf69191a081d7acc825cdf7aecf91c2ba9d66f29
SHA512bc8bdd31515c762ab065e744837f3fd449bb9553b1e11868dc0f96a12360b2889fbfb05a24ddd5ae43dc9f045275ad0573f8c6c4c39d8db9a5598323534f10ce
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\aaocmobhmglglhadegdjejcangmlkcbl\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\aaocmobhmglglhadegdjejcangmlkcbl\manifest.jsonFilesize
504B
MD5d532994175ac6e4e8fea2ae07edef6ff
SHA15646eab3cebc8b0a804103b63f08a63db784a77d
SHA256f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d
SHA512ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\y1NgQaU2oTpoza7.datFilesize
6KB
MD5301127baa271d9dc6425520414e911c0
SHA150593df9dcdcffa4b1253e9a51367b3e7df8e225
SHA2563ae0c534e288628d9f50f5e8ed2a8d818a5fb54a0c6c55100b0dccae66f28dfc
SHA5126adf578e88042ba025c3e67f771e5ca51a6c912e43fe3ab1daaa8a8fcd6c507c898bfc8e24da840fabafc1b872530ce46da98fd95d3bc7bd9dfe247837250cdd
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\y1NgQaU2oTpoza7.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
C:\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\y1NgQaU2oTpoza7.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dllFilesize
744KB
MD5fc8b2dfce95210e4fe59b69a454ce14a
SHA146acd69f9bc55784091a572c8aa4d4d153a874f8
SHA2563b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189
SHA5125ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf
-
\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.x64.dllFilesize
874KB
MD5c204b63eda2256280c0d74669210c890
SHA10a66d21505519e92683ac9845c3ff9ee6e196332
SHA256505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0
SHA5121bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425
-
\Users\Admin\AppData\Local\Temp\7zSE0CE.tmp\y1NgQaU2oTpoza7.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
memory/824-56-0x0000000000000000-mapping.dmp
-
memory/1488-78-0x000007FEFC161000-0x000007FEFC163000-memory.dmpFilesize
8KB
-
memory/1488-77-0x0000000000000000-mapping.dmp
-
memory/1732-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/2008-73-0x0000000000000000-mapping.dmp