c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe
Size

920KB
MD5

f9b9e04cf0fb0b2c12d991b71f6f1b1f
SHA1

7b30b0ed4e14d946fa89d6f27c94eb74f94e176c
SHA256

c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d
SHA512

e20f62c7882fa92301195cffce91e4fdd88a5c51781026bb827ac949a210c81e278e27606476a9ae7596e08ea8ed69f21636c49fa5a8bfd41b5502ad86caf9bd
SSDEEP

24576:h1OYdaOjMtdHAqcdDVhYwiei7+EpFAh/kKP:h1OsePHVmVhYwiLtKkKP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

AXjMoicRNGi1p9I.exe

pid process

1472 AXjMoicRNGi1p9I.exe
Loads dropped DLL 1 IoCs

Processes:

c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe

pid process

956 c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
956	c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe

Drops Chrome extension 3 IoCs

Processes:

AXjMoicRNGi1p9I.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmgbfiplkicigmokpbbndjohdjceca\2.0\manifest.json	AXjMoicRNGi1p9I.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmgbfiplkicigmokpbbndjohdjceca\2.0\manifest.json	AXjMoicRNGi1p9I.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmgbfiplkicigmokpbbndjohdjceca\2.0\manifest.json	AXjMoicRNGi1p9I.exe

Drops file in System32 directory 4 IoCs

Processes:

AXjMoicRNGi1p9I.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	AXjMoicRNGi1p9I.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	AXjMoicRNGi1p9I.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	AXjMoicRNGi1p9I.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	AXjMoicRNGi1p9I.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

AXjMoicRNGi1p9I.exe

pid	process
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe
1472	AXjMoicRNGi1p9I.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AXjMoicRNGi1p9I.exe

description	pid	process
Token: SeDebugPrivilege	1472	AXjMoicRNGi1p9I.exe
Token: SeDebugPrivilege	1472	AXjMoicRNGi1p9I.exe
Token: SeDebugPrivilege	1472	AXjMoicRNGi1p9I.exe
Token: SeDebugPrivilege	1472	AXjMoicRNGi1p9I.exe
Token: SeDebugPrivilege	1472	AXjMoicRNGi1p9I.exe
Token: SeDebugPrivilege	1472	AXjMoicRNGi1p9I.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe

description	pid	process	target process
PID 956 wrote to memory of 1472	956	c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe	AXjMoicRNGi1p9I.exe
PID 956 wrote to memory of 1472	956	c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe	AXjMoicRNGi1p9I.exe
PID 956 wrote to memory of 1472	956	c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe	AXjMoicRNGi1p9I.exe
PID 956 wrote to memory of 1472	956	c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe	AXjMoicRNGi1p9I.exe

C:\Users\Admin\AppData\Local\Temp\c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe
"C:\Users\Admin\AppData\Local\Temp\c14be4245e5b0dbb59b3289ae2f378f52f8dce7ece445851d4d147cb6eb1941d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\AXjMoicRNGi1p9I.exe
.\AXjMoicRNGi1p9I.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\AXjMoicRNGi1p9I.dat
Filesize
1KB

MD5
2f0f01642e7405c068899a41dc23165d

SHA1
9fa366514bc8debd1e1bb6c67fb530ea435edf16

SHA256
4c687b4a5621cb47ee436142089079606241b6c8c96c7189d94375f447eabf0d

SHA512
d943086d7236e92a24077d6f068298c961d1196fa39ac734468705494f65811549ed4c1467f87cbfa3db297d6677e6bbca38642204f7dffa09322ce987edd152

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\AXjMoicRNGi1p9I.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\V4M@E4mlqNj.org\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\V4M@E4mlqNj.org\chrome.manifest
Filesize
35B

MD5
9187bb82550034a999876a39ff274be6

SHA1
587f2d5a529349c505cb2eee981987e400d841a1

SHA256
44b0472fdbc16402cb16112727e4b8399d32536d2d8ef53a84844459fc247353

SHA512
47f7872cacee78eb330e7850b8c1fc2a4d4e524d75b0b2a0901d87f79057e7c9e7d24eb7e490e85192be4f0f7121e37f5e544a6f79fbfb4b08065d3347726aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\V4M@E4mlqNj.org\content\bg.js
Filesize
8KB

MD5
4859b9a8278c1f009d1271b99923f08b

SHA1
0d8d9dca36faf1d72dbfca347297b7dc57c77dd2

SHA256
87f82af03edf3299cafe4ccf7e90e2c5f466d611ff6aa1af6320da945a7e176f

SHA512
6df05d90d3fbfdc336ba54639364817c4876ade6cfc53d7fb59fc29131fba03aca5b0094a33bb035f86716066f2cfd5e16026d80061a3db5a37741b5c66b0724

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\V4M@E4mlqNj.org\install.rdf
Filesize
598B

MD5
65e5f87eab72a87914e83ae1d394dadc

SHA1
c50fd27e6ff0734206cddb9a7a4d6804297c2c15

SHA256
11abdf034730182a061ab67900485d4b89008866896e838b79680a5514073488

SHA512
2b14c095200b9f774df35914001848bd3e2786595a07540fb9e73bd7f4415747a23f58bebab9f66032d85fa26dbbb17931dabc8ae4d5fe8752a4e795c69c0758

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\hojmgbfiplkicigmokpbbndjohdjceca\MyuKNbN.js
Filesize
6KB

MD5
8dbba3d817664819d62ed6db693e1358

SHA1
524f81d0539ab5f16b6e10fbc746fdbf7e5ab3a2

SHA256
dc7077d6aa9bec7cabfe1d3544f9f3e93d2db8f44034a9ac921d3fecd50894a6

SHA512
1c8c578ab6d98d89f3a082e0f685d04012660c13a0f6f939a11fa53797d1645b42fc74cde191313a13b492878e113664b368eba61b27572b2aed3b058541eefa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\hojmgbfiplkicigmokpbbndjohdjceca\background.html
Filesize
144B

MD5
2f40ea52228d3960153f4566ae529d83

SHA1
ca32aecdc8f196f7216fd1236dfe7e1485e01729

SHA256
3d2c0616581b4d4f988e9b20d50482e168a71d84ffa50d59895f1f57e5758ae2

SHA512
c16d1ab17403108c66e5c248c9830c2aa159e47005de4289b0e0f11af6326dd8d03ba7c357b6a32d0463f68464b8a3158243c6fce196e88fcb27cb0ba4780367

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\hojmgbfiplkicigmokpbbndjohdjceca\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\hojmgbfiplkicigmokpbbndjohdjceca\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA719.tmp\hojmgbfiplkicigmokpbbndjohdjceca\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zSA719.tmp\AXjMoicRNGi1p9I.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/956-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1472-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads