Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe
Resource
win7-20221111-en
General
-
Target
c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe
-
Size
931KB
-
MD5
d2253c8d9e251f4b32378fd65969af2e
-
SHA1
272d4a9463f0252d7c8e7a923bb92c735c070642
-
SHA256
c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47
-
SHA512
370526f8a2a2e4c8db13100ea24dd7ae2d40c02c5466395c5881ca175d06e5a103369583bc38318f17c417a7b54b32bde1ee2a7a6019deac8c23449b559c1042
-
SSDEEP
24576:h1OYdaOpCZ/iWCvu/2sWsJA/jlt+DHhsb:h1OsfCpYO/dJJDHhsb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
0Qwa8MQ0gEzzYYj.exepid process 1372 0Qwa8MQ0gEzzYYj.exe -
Loads dropped DLL 1 IoCs
Processes:
c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exepid process 1512 c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
0Qwa8MQ0gEzzYYj.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjbgijhfgfkokojejkhoknecddeempgh\2.0\manifest.json 0Qwa8MQ0gEzzYYj.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjbgijhfgfkokojejkhoknecddeempgh\2.0\manifest.json 0Qwa8MQ0gEzzYYj.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjbgijhfgfkokojejkhoknecddeempgh\2.0\manifest.json 0Qwa8MQ0gEzzYYj.exe -
Drops file in System32 directory 4 IoCs
Processes:
0Qwa8MQ0gEzzYYj.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 0Qwa8MQ0gEzzYYj.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 0Qwa8MQ0gEzzYYj.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 0Qwa8MQ0gEzzYYj.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 0Qwa8MQ0gEzzYYj.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
0Qwa8MQ0gEzzYYj.exepid process 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe 1372 0Qwa8MQ0gEzzYYj.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
0Qwa8MQ0gEzzYYj.exedescription pid process Token: SeDebugPrivilege 1372 0Qwa8MQ0gEzzYYj.exe Token: SeDebugPrivilege 1372 0Qwa8MQ0gEzzYYj.exe Token: SeDebugPrivilege 1372 0Qwa8MQ0gEzzYYj.exe Token: SeDebugPrivilege 1372 0Qwa8MQ0gEzzYYj.exe Token: SeDebugPrivilege 1372 0Qwa8MQ0gEzzYYj.exe Token: SeDebugPrivilege 1372 0Qwa8MQ0gEzzYYj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exedescription pid process target process PID 1512 wrote to memory of 1372 1512 c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe 0Qwa8MQ0gEzzYYj.exe PID 1512 wrote to memory of 1372 1512 c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe 0Qwa8MQ0gEzzYYj.exe PID 1512 wrote to memory of 1372 1512 c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe 0Qwa8MQ0gEzzYYj.exe PID 1512 wrote to memory of 1372 1512 c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe 0Qwa8MQ0gEzzYYj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe"C:\Users\Admin\AppData\Local\Temp\c1851e556d73a718c21c0d3ab8a7cc1a99c4804a1a76c361475baf74639e6f47.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\0Qwa8MQ0gEzzYYj.exe.\0Qwa8MQ0gEzzYYj.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\0Qwa8MQ0gEzzYYj.datFilesize
1KB
MD5cce7e0c21764304c471f8fa25d2972f7
SHA17a7fc5fe770a09b2dd1aa34e2663d7d97add291e
SHA2563e07126fdeb898b523ef8a2f99b4a557710a17862d2e2010bd623b6508674b81
SHA5122866bd50c7ca2df500d33135d035d4dc207503196d60985c2e9e3af5da479cbf0b45d9264ca64e872cacc1a6181fbafb09285d6dc069e6b35501a06119c8b90d
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\0Qwa8MQ0gEzzYYj.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\fjbgijhfgfkokojejkhoknecddeempgh\background.htmlFilesize
142B
MD5bd38ec86d7855a2da20bc7820a59363c
SHA135a352065dcaebb4f1ef57151d4d5e01e8a1b17a
SHA25621e8dc1d6095125cd1a54df153eb4974d39e8ae48b8665b3356d92864b51c54e
SHA512a933bf6c0506ffeb70861a79216cb7007107698798ec085300bd0564d6abf63145d1996dfc30af84b69249a1406d3015fefe90acd20c45f3c6179f111cba9df0
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\fjbgijhfgfkokojejkhoknecddeempgh\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\fjbgijhfgfkokojejkhoknecddeempgh\gDPgB.jsFilesize
6KB
MD52e5f7bb77a06e09957331b21be2b5436
SHA1eef3aab881a3872f310b460698ef0ecfa674a9e4
SHA25631f655767b154358802f335404a4605fea8118418c7d9f61aa48e76b396fdc77
SHA5122bd08029e6aa0c0e5b18fa8797447e051ceda2eb5c6682843d4d59d31d6325b52079b0d2797d9d6d3c82aade24660c3bb72c109d20dbf0da36f2c489f793af8c
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\fjbgijhfgfkokojejkhoknecddeempgh\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\fjbgijhfgfkokojejkhoknecddeempgh\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\txJL@Qj.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\txJL@Qj.com\chrome.manifestFilesize
35B
MD58d85b6b08f216660cd9f6087e273743e
SHA1ceebe3a29aa1c103e30aed3764e1256a13abba0c
SHA256dec96e158a2a30ca4b4f3d8918902cb737b8008e71afeebae18175593daaf80d
SHA512601644c170c341305226403a2c31c4db18439f9d5928b0b5a6776542561b7dc3672a74a92680d6f0b709210564abc898ef49e096f4f2ed8729fae88988d561fb
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\txJL@Qj.com\content\bg.jsFilesize
8KB
MD5b3f5a4f74efd14b38cab761dda9faba6
SHA157ccdbee229dfdd1f664892211eabcbb6ab4f93e
SHA256bd927a2a5c756d598ef3e28e8ccaf43b108dc7cbd4b269267bbac92cd452e0dd
SHA512934f1ee8431ee3244d6732f070334914e4c232f38bf2fb13e0a26aeeee5f7542856e90f5140e7924c3f087793ba9c4a8c5fa913b4ee69755eb573de016429c82
-
C:\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\txJL@Qj.com\install.rdfFilesize
594B
MD5b007dad79190a43d30bfd740b4e69a64
SHA13dd0e37225d39c69e88456bb26d40faf5e7fe0a2
SHA2569c5844dc46043f560b65de42e31dab16085b35e1fdc6c48e83a9940a652bf26a
SHA512826a65f814064526bccb190b96bd6a318b171de25883780b77a50ca3dd56976995b77ccf6d49a35972dd07b7127c00b3aff68b6832802fb1d140e7debfaf28d3
-
\Users\Admin\AppData\Local\Temp\7zS9A3E.tmp\0Qwa8MQ0gEzzYYj.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1372-56-0x0000000000000000-mapping.dmp
-
memory/1512-54-0x0000000074C41000-0x0000000074C43000-memory.dmpFilesize
8KB