c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11

Analysis

max time kernel
123s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe
Size

922KB
MD5

8e6c7d5cbf7acaf5879f752fdb4bf52a
SHA1

a242042033d4201e0845a72ba813e8d5d1dd3c77
SHA256

c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11
SHA512

3a4601695a7aa1b2e7239fd6c61d578559755c1ef3daf6e14f652504caa6ffdbeac1746f257eb355a5c412b151822ea70077854983a611a6212bbe49b91034e2
SSDEEP

24576:h1OYdaO6S/Yq4hD9S9Acd+lMbXYN9MKONgRsAI:h1OsAYYrS9ldCM8N9MoRsAI

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ab2dw06CzeEAW8D.exe

pid process

1484 ab2dw06CzeEAW8D.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ab2dw06CzeEAW8D.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncoeljbhonoihgbekioaocoeiejdadn\2.0\manifest.json	ab2dw06CzeEAW8D.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncoeljbhonoihgbekioaocoeiejdadn\2.0\manifest.json	ab2dw06CzeEAW8D.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncoeljbhonoihgbekioaocoeiejdadn\2.0\manifest.json	ab2dw06CzeEAW8D.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncoeljbhonoihgbekioaocoeiejdadn\2.0\manifest.json	ab2dw06CzeEAW8D.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncoeljbhonoihgbekioaocoeiejdadn\2.0\manifest.json	ab2dw06CzeEAW8D.exe

Drops file in System32 directory 4 IoCs

Processes:

ab2dw06CzeEAW8D.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ab2dw06CzeEAW8D.exe
File opened for modification	C:\Windows\System32\GroupPolicy	ab2dw06CzeEAW8D.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ab2dw06CzeEAW8D.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ab2dw06CzeEAW8D.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ab2dw06CzeEAW8D.exe

pid	process
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe
1484	ab2dw06CzeEAW8D.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ab2dw06CzeEAW8D.exe

description	pid	process
Token: SeDebugPrivilege	1484	ab2dw06CzeEAW8D.exe
Token: SeDebugPrivilege	1484	ab2dw06CzeEAW8D.exe
Token: SeDebugPrivilege	1484	ab2dw06CzeEAW8D.exe
Token: SeDebugPrivilege	1484	ab2dw06CzeEAW8D.exe
Token: SeDebugPrivilege	1484	ab2dw06CzeEAW8D.exe
Token: SeDebugPrivilege	1484	ab2dw06CzeEAW8D.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe

description	pid	process	target process
PID 1828 wrote to memory of 1484	1828	c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe	ab2dw06CzeEAW8D.exe
PID 1828 wrote to memory of 1484	1828	c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe	ab2dw06CzeEAW8D.exe
PID 1828 wrote to memory of 1484	1828	c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe	ab2dw06CzeEAW8D.exe

C:\Users\Admin\AppData\Local\Temp\c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe
"C:\Users\Admin\AppData\Local\Temp\c0a1c816e3851f84703f04b2a68adcf3907d7d63b2f6ba31d57a48745a0c8e11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\ab2dw06CzeEAW8D.exe
.\ab2dw06CzeEAW8D.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\ab2dw06CzeEAW8D.dat
Filesize
1KB

MD5
247b4efe082421337e8ce9efb16c4a32

SHA1
9fb351eb8a8fd57029c321123ffe774d4698704f

SHA256
9abd3838f3d7404a813421697737f36487789a58f8c670c27a8d620c920f11b0

SHA512
bed095a0ca157eff6c572259054cf4df91be757bc0c60a6bdbb22fa4c43cd22aecc43b0f3a2db01932b4f748013ecce0ba5dc280b2bee6cc8125276c13bd2dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\ab2dw06CzeEAW8D.exe
Filesize
762KB

MD5
8a601a779c987e9dfa9e5aabda8a5761

SHA1
a9a36a255bfd43348aa1b5f8540bf165cba99b04

SHA256
d21458e37a24270fcecc1666a27cd5bef9468c2d1f77c423fa6ae8094f6b8e28

SHA512
6e6e7947636b0eff6bc0c2a10923ad50e5423dcef8ffbc75160b47a5a485bc22bdd8edfed9a895defddc876991a51488436fba7f1cc18ce8df1980c4b90c215d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\ab2dw06CzeEAW8D.exe
Filesize
762KB

MD5
8a601a779c987e9dfa9e5aabda8a5761

SHA1
a9a36a255bfd43348aa1b5f8540bf165cba99b04

SHA256
d21458e37a24270fcecc1666a27cd5bef9468c2d1f77c423fa6ae8094f6b8e28

SHA512
6e6e7947636b0eff6bc0c2a10923ad50e5423dcef8ffbc75160b47a5a485bc22bdd8edfed9a895defddc876991a51488436fba7f1cc18ce8df1980c4b90c215d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\cncoeljbhonoihgbekioaocoeiejdadn\OWdyd5JTj.js
Filesize
6KB

MD5
350ff350245d2896ff37fe4710fb7fab

SHA1
927fb7877f64f6327469a5d7a41cd93a20127b5f

SHA256
4336092b10abc0ba25024be891736751cf4eb105d3f3abaf9a6677b5ed1f1adf

SHA512
18696d1bf24614d167e85ade82026ae80e701986e46afb68ae6af4761a793cb9e33c847de1497d685571491997925cbaae6be4adcfe0c95895e518e0806a6b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\cncoeljbhonoihgbekioaocoeiejdadn\background.html
Filesize
146B

MD5
407e0ba26ce815784167d57827bc5fc9

SHA1
c753cedfed61553cd5d55cec3a65fe9662a18ed1

SHA256
b1cfce2ef999387a9ede6f00ab6895f5f6ce1054e1028be5cf36fd3f10b9fdea

SHA512
bb0eb3006ab0904bd2d81430e1198bcd8c81794a5517bedf22a4f1e30e41810837b24e54f8f8cc2207e76220d790f6fb853fd205aa80557ff1adc3401af8c8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\cncoeljbhonoihgbekioaocoeiejdadn\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\cncoeljbhonoihgbekioaocoeiejdadn\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\cncoeljbhonoihgbekioaocoeiejdadn\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
a4719cdd3f065127d7f0632b9a5ebb10

SHA1
011bd84cb3963b77169595a25dd31f885d5c63cb

SHA256
4c1d270d7ebfe232b2d50d7a49a474f54d16f0a661354024c452c976c8f3b7d5

SHA512
066f38499fbb190fce54da82aa922d40ae0ce432932f312c919590df4e1d18ae3f1279f818efb22220af70c6d95d892ddae3ad8706cc314b2c6c20f601ed843d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
83dc5085a064ba10913868e7b2048938

SHA1
541203c3cdbc8cd255ae85c49a5923e656db8396

SHA256
0acfced3b5ff7a5b3f53efa9a5ef77ff28497f6d5ef9ad496d23422280442473

SHA512
a2b48cabe0a127b374c8ce65e58f71cf2cfd787e26f5b6dfefc911c896214b11edce9560a8dd8dd9ef96566692d36a8340753d00d00dc0d06bd28615c4d97d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA3C6.tmp\[email protected]\install.rdf
Filesize
598B

MD5
7218d1c1510acdc7b219efa81dcbc853

SHA1
b136b2d178c6247eb30467c8ac96befcabfd6829

SHA256
d435f0676fe113f378c465466b7453787c897d37b26b96f57d952b7bf5894974

SHA512
ff330afe29e6b463f99a2cae9f2af6f95434a0238d634882d9890fd6d469fdf8ab8637d34b90de61c6fde4c5fd2f7edc20077a26696effe9e7f473a51ae6702b

Download Submit
memory/1484-132-0x0000000000000000-mapping.dmp

Download