Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe
Resource
win7-20220812-en
General
-
Target
c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe
-
Size
931KB
-
MD5
ca5b0cec689299fa6dd62da81c85051c
-
SHA1
c151774e331ccf430eb871c1894f8c839200a1f5
-
SHA256
c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a
-
SHA512
db9732fe50fcef54e7bdb26ecc7044937e4c008c7c86fc707a679c9939a2398b5ee486fc7272f798a7c2694a0bcfbe93562ab8b6406977afd5c2dc682f825482
-
SSDEEP
24576:h1OYdaOKCZ/iWCvu/2sWsJA/jlt+DHhs7:h1Os0CpYO/dJJDHhs7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
u4VHRM0sInZr2EJ.exepid process 2056 u4VHRM0sInZr2EJ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
u4VHRM0sInZr2EJ.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlebnlifegafkofdhihjlgdnkneclfcd\2.0\manifest.json u4VHRM0sInZr2EJ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlebnlifegafkofdhihjlgdnkneclfcd\2.0\manifest.json u4VHRM0sInZr2EJ.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlebnlifegafkofdhihjlgdnkneclfcd\2.0\manifest.json u4VHRM0sInZr2EJ.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlebnlifegafkofdhihjlgdnkneclfcd\2.0\manifest.json u4VHRM0sInZr2EJ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlebnlifegafkofdhihjlgdnkneclfcd\2.0\manifest.json u4VHRM0sInZr2EJ.exe -
Drops file in System32 directory 4 IoCs
Processes:
u4VHRM0sInZr2EJ.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy u4VHRM0sInZr2EJ.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini u4VHRM0sInZr2EJ.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol u4VHRM0sInZr2EJ.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI u4VHRM0sInZr2EJ.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
u4VHRM0sInZr2EJ.exepid process 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe 2056 u4VHRM0sInZr2EJ.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exedescription pid process target process PID 4464 wrote to memory of 2056 4464 c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe u4VHRM0sInZr2EJ.exe PID 4464 wrote to memory of 2056 4464 c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe u4VHRM0sInZr2EJ.exe PID 4464 wrote to memory of 2056 4464 c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe u4VHRM0sInZr2EJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe"C:\Users\Admin\AppData\Local\Temp\c19d9bb5d18c50a9628cf6de588bd2d32ce086bfc98360b3a544df60ddfca20a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\u4VHRM0sInZr2EJ.exe.\u4VHRM0sInZr2EJ.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\cx@h.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\cx@h.net\chrome.manifestFilesize
35B
MD588a889385de870e7b18833521afc6bb5
SHA18dde5eaa95eb456d790a27bcd8a3388b292a65ac
SHA256d606cb831b430c5108f2c1a22d953cd52dd3d44724b6c157b3d93b2d6fb7278f
SHA5125f5e91f167b7f21bab37c002dcee14c11de1b85978370f3687012add0df4c9802006e6d7740cafee99dfc5072daaae6073e6ba4d6fe4d4ab185e6ad46eb0df30
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\cx@h.net\content\bg.jsFilesize
8KB
MD520955388cba1bab1606c2309e9ad85d2
SHA1d76e6547c47a8226b39758018f42fdd3a1a8a99f
SHA25647b3871093890358389c9cbcb95cc89385c7e3e1c331aaa40aefd2653338c63f
SHA5123401d70b90e0c4c51a6f975aacf70e163388981ad8b7a5378d1fc26c24541c99eec1ce1b6faf1f3d862a62b9f156cc1ac2261341fe59bf339a9346e21a8ee2d5
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\cx@h.net\install.rdfFilesize
593B
MD5fb91530e5dc96bac45f4ff3646e5c3a0
SHA1b72d5c02af7e7d6b6a97c79d10a983d72f70a984
SHA25634a13e0804445bea98bd3a12ac48af062a5a775b00027ea57d399692a782c4e3
SHA5122ae10827a3e8637432474c3a70b63f66278d7dbe253bd392bb1465365ce31ce7f6e83bf57b16eb656636f04cb83031381f095e23fccc27227acb498552a2eb06
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\dlebnlifegafkofdhihjlgdnkneclfcd\background.htmlFilesize
142B
MD5cbf302aba18c44206034e5b9e57a6904
SHA1c6353dde08f99b587686dd0ecfd056e1e2e71a5f
SHA2565f27e08f00a2a90c64a43a268aa3e6c68853c4f0d07411877e81b8f9973603f5
SHA512c08bdb8df2fdcd54429e6523a6fa256c7280947893744067b3c908d4d40575b1524ee69e13ec851663ff049e2f801772af5087b91303be7e8f2090d8b2a5bed8
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\dlebnlifegafkofdhihjlgdnkneclfcd\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\dlebnlifegafkofdhihjlgdnkneclfcd\gY6fO.jsFilesize
6KB
MD53b3ed543ec2254114eb54147d68e5abb
SHA13e2cef2d1895734f99404afbf6e08d0378245428
SHA256f0fa8809d2dc30848fc3c58cc264b1e2cec2104f60fce1a42c3dca2fb7dd69bb
SHA51277ccfe5a20a3fdb59f7536df63016eac815a5a90a4a76ab3c2983b601f15ab933cf8f4756ee822bfbebbe2d7bbcc5d1c03ca6f6bfedb6342bd28e8e9f698ea64
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\dlebnlifegafkofdhihjlgdnkneclfcd\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\dlebnlifegafkofdhihjlgdnkneclfcd\manifest.jsonFilesize
501B
MD505edf5ac117c006abc1847e8b5331f6c
SHA1e0f45e5897a8967ef33599b72e7fdf3beb72d239
SHA256b133bb8163ec7bb48118724f8d3e8eac8f9da6c579ac65a2b5aaa1b9653b6c18
SHA5129607b0c9c0add5c85403532aad754f8b51ecbb134b0a5e54bdcc26c8185eee26fff39ad420e905b9e014b5c2518949ca1f4a7c26ae987e3e4d0853aba2d878c9
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\u4VHRM0sInZr2EJ.datFilesize
1KB
MD5dd9f23a561a451db88ff286823dd55de
SHA107860ce3da3bd72e48b5cb2bf3c9c1ff9bf8009e
SHA256c2ace7f899181ca750c1d383a7fea79857998af6b8ad86199147b1b4757af559
SHA51249651e2d9ad679de87506ca68fc81d9fefdb25e887a5960ca84a6214b779dc69a90425536de7502365231dd7044280fddb74dc7279247b1ed8952ee64f9540ce
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\u4VHRM0sInZr2EJ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS7E9B.tmp\u4VHRM0sInZr2EJ.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/2056-132-0x0000000000000000-mapping.dmp