Analysis
-
max time kernel
259s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe
Resource
win7-20220812-en
General
-
Target
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe
-
Size
2.5MB
-
MD5
37dd51acc78742b396476ff38375aaba
-
SHA1
b37ca7082a493feb34153a0af29fe0c8dddbda30
-
SHA256
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38
-
SHA512
14bcde6883594595845aac170d46495efba7bb8fded8abab0514830eb8b428d5ecf80bf22568d26efa86c6632a962ff8e0a196befe0b5211b7250d910564f127
-
SSDEEP
49152:h1OslUc3R1YQeb1bR9qMS3te/+E+kzkeRutdQ3L3V/A9VeC:h1OgbRsTWe/Zo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
y1NgQaU2oTpoza7.exepid process 736 y1NgQaU2oTpoza7.exe -
Loads dropped DLL 1 IoCs
Processes:
y1NgQaU2oTpoza7.exepid process 736 y1NgQaU2oTpoza7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 5 IoCs
Processes:
y1NgQaU2oTpoza7.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaocmobhmglglhadegdjejcangmlkcbl\200\manifest.json y1NgQaU2oTpoza7.exe -
Drops file in Program Files directory 6 IoCs
Processes:
y1NgQaU2oTpoza7.exedescription ioc process File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dat y1NgQaU2oTpoza7.exe File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dat y1NgQaU2oTpoza7.exe File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dll y1NgQaU2oTpoza7.exe File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dll y1NgQaU2oTpoza7.exe File created C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.tlb y1NgQaU2oTpoza7.exe File opened for modification C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.tlb y1NgQaU2oTpoza7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
y1NgQaU2oTpoza7.exepid process 736 y1NgQaU2oTpoza7.exe 736 y1NgQaU2oTpoza7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exedescription pid process target process PID 4356 wrote to memory of 736 4356 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe PID 4356 wrote to memory of 736 4356 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe PID 4356 wrote to memory of 736 4356 c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe y1NgQaU2oTpoza7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe"C:\Users\Admin\AppData\Local\Temp\c132ad86fbcc29f69bc14ef3ae8f41d55203c9fc7de22f88a7a9026323d2fc38.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\y1NgQaU2oTpoza7.exe.\y1NgQaU2oTpoza7.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Browser Shop\RSjxNRN5tJGNOK.dllFilesize
744KB
MD5fc8b2dfce95210e4fe59b69a454ce14a
SHA146acd69f9bc55784091a572c8aa4d4d153a874f8
SHA2563b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189
SHA5125ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\0w@7.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\0w@7.net\chrome.manifestFilesize
35B
MD5918e9c780277b68cad882ec0dea1b422
SHA165089dbc8294fb74b1136977b6b704ff7fec6cd0
SHA25699db5e89bad0a55b24c8d76d51f2dcd3f4969f6691c8d8bb8594a857ee061e81
SHA512094c2a919793d62bcec50769d0cbbce4bc45f04d3031416da9ec3558032ef04e2904862737a701fe49eb0625a7e4a6c6f8e801bcbd41b6529e1ef80faf458ae2
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\0w@7.net\content\bg.jsFilesize
7KB
MD5fb38109c9b85e2d94d6ae8d825eddc8d
SHA15511f24cf7e52b40f1b480c95d9ca9c2268e243a
SHA256459fbf3ad6a4c750f08f2dbc6e7f82e1bab5ea88498e76778016ef72eeec3d63
SHA512d9aff020e199d77abb34dcd1f61587467840ca8b82006b984a94668a610201f015d31c090db8da0c44b013fd0a4564d3b521e6ffdc930f0ee45556fb3610b514
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\0w@7.net\install.rdfFilesize
597B
MD54f421c53a4969ec345df83ae6199860b
SHA1b2bdebf18585387d80bc7507358040224bdad890
SHA2561e145efc59a86858b1a25a81c9bf6a8b46f29392d1321d1381595b109fad78cd
SHA51214020e875cfb6d44ad6c357c8b21f4590918d2f4ee487bcf1b3413317e7c0b1d60ce41f659fd219ed617e8fe62ac062ff1dc053b408b4546af4708ec30aa4491
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\RSjxNRN5tJGNOK.dllFilesize
744KB
MD5fc8b2dfce95210e4fe59b69a454ce14a
SHA146acd69f9bc55784091a572c8aa4d4d153a874f8
SHA2563b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189
SHA5125ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\RSjxNRN5tJGNOK.tlbFilesize
3KB
MD5662093ad59715d81e0a2b7cfbd4ac684
SHA183419c0803aa1c25a27b1fb8ad4a663d2d4878b0
SHA25668fc930e26f7f38e30df8f8f40d1232b81af62d4cf27a281a8f645788ad1f6c4
SHA5120eaffb7f011f548e1c6f8490c3d353fa05976140383df85663b5ef13be110d4847f08afe236a796a7f10a28895d29a7344e6d346389aa0780cc24af50fd66bf6
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\aaocmobhmglglhadegdjejcangmlkcbl\background.htmlFilesize
145B
MD51b19fb4cc57a7fa6e40c7f60a5ac3922
SHA1c46a0752d34cd498cfb1293f3917d277d7180807
SHA256bd6e13c2736b63e67fbed3a08281b73329840ca5291d8e475a104322c79b7da0
SHA512eed5ca8a8e019f95af4f43771e3b43e0e369df6d26c8001faadac03d0dfc6b9908f13ca31d85f051e1fbebeb97336a2d4a50f2aacfdfb08d4bdd863d166f4397
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\aaocmobhmglglhadegdjejcangmlkcbl\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\aaocmobhmglglhadegdjejcangmlkcbl\j47VSQbU.jsFilesize
5KB
MD5754468b9cd4c0cc1a64789ed28bdd1f0
SHA162d1ddb6f16b3cd85fd1e7ae29fd5844a090a504
SHA256a145c6cacd508ec080615f3bbf69191a081d7acc825cdf7aecf91c2ba9d66f29
SHA512bc8bdd31515c762ab065e744837f3fd449bb9553b1e11868dc0f96a12360b2889fbfb05a24ddd5ae43dc9f045275ad0573f8c6c4c39d8db9a5598323534f10ce
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\aaocmobhmglglhadegdjejcangmlkcbl\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\aaocmobhmglglhadegdjejcangmlkcbl\manifest.jsonFilesize
504B
MD5d532994175ac6e4e8fea2ae07edef6ff
SHA15646eab3cebc8b0a804103b63f08a63db784a77d
SHA256f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d
SHA512ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\y1NgQaU2oTpoza7.datFilesize
6KB
MD5301127baa271d9dc6425520414e911c0
SHA150593df9dcdcffa4b1253e9a51367b3e7df8e225
SHA2563ae0c534e288628d9f50f5e8ed2a8d818a5fb54a0c6c55100b0dccae66f28dfc
SHA5126adf578e88042ba025c3e67f771e5ca51a6c912e43fe3ab1daaa8a8fcd6c507c898bfc8e24da840fabafc1b872530ce46da98fd95d3bc7bd9dfe247837250cdd
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\y1NgQaU2oTpoza7.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
C:\Users\Admin\AppData\Local\Temp\7zSAFA4.tmp\y1NgQaU2oTpoza7.exeFilesize
762KB
MD5468f56fce4a9413059464fa7c9c3cc5f
SHA199dde68e6dca34b5787c1e2faeab1716f443e462
SHA2561b0cefe330725f38dd592a9900eeca832124643d3a170805ad7cd988dc312841
SHA51211bf2744d92faaa1e13bb316d3d56555fd5bb8a8248fde6bbca1f692cc55928ec901cc1cc79c09f236273e25712526dd629fd97aec4f062d469c9714d1a6a7d0
-
memory/736-132-0x0000000000000000-mapping.dmp