c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87

Analysis

max time kernel
22s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe
Size

931KB
MD5

3496616bf4e850d3aab7aa0324bde12d
SHA1

463a5e9b47c818dbc84febb46e7eab2c7e78dd8d
SHA256

c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87
SHA512

48cbdfd9e78f6cc50db332b92ae35019777a993948222a24802e71a172093cb7735b10c842c67ec139740d7238bc9e004d57591cfab95d4c602f209ae393cb47
SSDEEP

24576:h1OYdaOwCZ/iWCvu/2sWsJA/jlt+DHhsb:h1Os2CpYO/dJJDHhsb

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

FMtlyMEhcxmqPlq.exe

pid process

1920 FMtlyMEhcxmqPlq.exe
Loads dropped DLL 1 IoCs

Processes:

c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe

pid process

1932 c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1932	c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe

Drops Chrome extension 3 IoCs

Processes:

FMtlyMEhcxmqPlq.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdihkkikgcbdeajhlnpnbfjdaaadojnd\2.0\manifest.json	FMtlyMEhcxmqPlq.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdihkkikgcbdeajhlnpnbfjdaaadojnd\2.0\manifest.json	FMtlyMEhcxmqPlq.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdihkkikgcbdeajhlnpnbfjdaaadojnd\2.0\manifest.json	FMtlyMEhcxmqPlq.exe

Drops file in System32 directory 4 IoCs

Processes:

FMtlyMEhcxmqPlq.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	FMtlyMEhcxmqPlq.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	FMtlyMEhcxmqPlq.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	FMtlyMEhcxmqPlq.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	FMtlyMEhcxmqPlq.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

FMtlyMEhcxmqPlq.exe

pid	process
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe
1920	FMtlyMEhcxmqPlq.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

FMtlyMEhcxmqPlq.exe

description	pid	process
Token: SeDebugPrivilege	1920	FMtlyMEhcxmqPlq.exe
Token: SeDebugPrivilege	1920	FMtlyMEhcxmqPlq.exe
Token: SeDebugPrivilege	1920	FMtlyMEhcxmqPlq.exe
Token: SeDebugPrivilege	1920	FMtlyMEhcxmqPlq.exe
Token: SeDebugPrivilege	1920	FMtlyMEhcxmqPlq.exe
Token: SeDebugPrivilege	1920	FMtlyMEhcxmqPlq.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe

description	pid	process	target process
PID 1932 wrote to memory of 1920	1932	c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe	FMtlyMEhcxmqPlq.exe
PID 1932 wrote to memory of 1920	1932	c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe	FMtlyMEhcxmqPlq.exe
PID 1932 wrote to memory of 1920	1932	c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe	FMtlyMEhcxmqPlq.exe
PID 1932 wrote to memory of 1920	1932	c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe	FMtlyMEhcxmqPlq.exe

C:\Users\Admin\AppData\Local\Temp\c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe
"C:\Users\Admin\AppData\Local\Temp\c120c474b07796922cdae531df0e9e5de5f9c4ebe474c765b0c842c64d68ff87.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\FMtlyMEhcxmqPlq.exe
.\FMtlyMEhcxmqPlq.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\FMtlyMEhcxmqPlq.dat
Filesize
1KB

MD5
b437d476a6ef7acc8ba43f1bbe1fc7c4

SHA1
8a9b2b6d846b00a2bd6de9940674fb442a2dda28

SHA256
c7793fb7c7d8f4314a91b238d3e39f88330a713346a66636cd4e99864a28c1d6

SHA512
aad91b3d12999067722e8d9f8a69a95af7028893456c183bc1ae89f7399f550654aa31ac636628e8b71b6f275d86c13b641c0c25c4138da32bf58b6a361c899a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\FMtlyMEhcxmqPlq.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
06c9799e54d1705daf707f13ff0a5721

SHA1
c920cef349a46e20b984ce4d3f948fb08dbd598b

SHA256
d918feac83a295512f1259a90709bda98cc3c127412e84d12c65824e554bdd23

SHA512
e68b241a476bb1b135a5540c99371b0ca349c887fd6c241debc72942db8656db45beb63864531ee5a3afb99cc4c36a2ba29dc5e0f532cdc083d90c24f1c42abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
3c5d5e1b72176176137dbc69c4aa8510

SHA1
cbcdd674e8148a65c1b4122bbcbe0a9c556654aa

SHA256
7d4a151fe1deaaca7880c2ca302a267f4db4eaa327b9227b920496f7993e693c

SHA512
e0cb9a875436de01842b2c4d3dc0fa04d5b03a372bff3d47d04a11b4c34ca081957161b1e72b50d7be9805d08e68ce645eff5d81fbef3a5a5f9430c966745458

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\[email protected]\install.rdf
Filesize
595B

MD5
6315b48090c6bc78a4c75aae80692a76

SHA1
373fa3a35e8af77c516f35cd9a7ad069c71f871a

SHA256
b7d6d454d1bc52d08d82b02830951ae00a8008f06a91b137a4717796d4ef00d2

SHA512
da650e4733b1ad5cff368dc700c1ab59ba166aedede4f20ad6114355539c7425b3786016f5580a6666c81f94602938d892b1c85bd1ec91de8996f15c9a367615

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\cdihkkikgcbdeajhlnpnbfjdaaadojnd\Rujbtp.js
Filesize
6KB

MD5
abbbacb5c265b2239b23bf2c3f5944ac

SHA1
f31279f0432197376c9a05cd746d2b42d982e790

SHA256
cb1420f3039849d2a10e5b75c0b80a71cf1d5f54dd7b38c1a3db43f36ad99c74

SHA512
21c3fdfb467988eee64b9db237017de8fb582f056eba4f6cec8e3636f63b2ecf853a7cb267c198b57589edcdee21cfdeb9302476bba5f6df1751eee519042685

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\cdihkkikgcbdeajhlnpnbfjdaaadojnd\background.html
Filesize
143B

MD5
8dc0b518f91cbb49d488bec18e4a761a

SHA1
e0752ffb29afe004ec88ab6c513d6b9b07570b3d

SHA256
903a0eeb76fda3960fb20cff627fd8c28cc89a6a9cca37fa682d64425146cd0e

SHA512
c5639132a8e0f826475180c78121bfb48d587d0065a29a7b09126ad1d95fba0c1b7b23464c1ca8194dbd8e3e8d23c6be3dc11d146499bd38f73e153a3bf6126f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\cdihkkikgcbdeajhlnpnbfjdaaadojnd\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\cdihkkikgcbdeajhlnpnbfjdaaadojnd\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\cdihkkikgcbdeajhlnpnbfjdaaadojnd\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3EF5.tmp\FMtlyMEhcxmqPlq.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1920-56-0x0000000000000000-mapping.dmp

Download
memory/1932-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads