c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exe
Size

2.5MB
MD5

7ccb686df8200212751a0ceba2bef774
SHA1

96d66fa6607f67378105d64132ad8c438126da45
SHA256

c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d
SHA512

e43cf0a4a81453e0612e07f605c10eef822fccd6407ed2e3f300e3b5c7e77e5c17749b83264b2a12f3471a52a237fc341c77921933304f626816cfcacb6d3636
SSDEEP

49152:h1OsLTAHQDPTB3RnKWXUjuxZsHKddXx/WPKGL2ONrq8J8aUnbeZ9F:h1O+TAqMjuxZH/Wpd3

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

n1CFTmo49jQLRYI.exe

pid process

3044 n1CFTmo49jQLRYI.exe
Loads dropped DLL 3 IoCs

Processes:

n1CFTmo49jQLRYI.exeregsvr32.exeregsvr32.exe

pid process

3044 n1CFTmo49jQLRYI.exe
5044 regsvr32.exe
5048 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3044	n1CFTmo49jQLRYI.exe

pid	process
3044	n1CFTmo49jQLRYI.exe
5044	regsvr32.exe
5048	regsvr32.exe

Drops Chrome extension 5 IoCs

Processes:

n1CFTmo49jQLRYI.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\aimjmgkhdkbgpcimgjanikodhndihhji\2.0\manifest.json	n1CFTmo49jQLRYI.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\aimjmgkhdkbgpcimgjanikodhndihhji\2.0\manifest.json	n1CFTmo49jQLRYI.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\aimjmgkhdkbgpcimgjanikodhndihhji\2.0\manifest.json	n1CFTmo49jQLRYI.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aimjmgkhdkbgpcimgjanikodhndihhji\2.0\manifest.json	n1CFTmo49jQLRYI.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aimjmgkhdkbgpcimgjanikodhndihhji\2.0\manifest.json	n1CFTmo49jQLRYI.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

n1CFTmo49jQLRYI.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	n1CFTmo49jQLRYI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	n1CFTmo49jQLRYI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	n1CFTmo49jQLRYI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	n1CFTmo49jQLRYI.exe

Drops file in Program Files directory 8 IoCs

Processes:

n1CFTmo49jQLRYI.exe

description	ioc	process
File created	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.tlb	n1CFTmo49jQLRYI.exe
File opened for modification	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.tlb	n1CFTmo49jQLRYI.exe
File created	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.dat	n1CFTmo49jQLRYI.exe
File opened for modification	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.dat	n1CFTmo49jQLRYI.exe
File created	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll	n1CFTmo49jQLRYI.exe
File opened for modification	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll	n1CFTmo49jQLRYI.exe
File created	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.dll	n1CFTmo49jQLRYI.exe
File opened for modification	C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.dll	n1CFTmo49jQLRYI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

n1CFTmo49jQLRYI.exe

pid process

3044 n1CFTmo49jQLRYI.exe
3044 n1CFTmo49jQLRYI.exe

pid	process
3044	n1CFTmo49jQLRYI.exe
3044	n1CFTmo49jQLRYI.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exen1CFTmo49jQLRYI.exeregsvr32.exe

description	pid	process	target process
PID 2420 wrote to memory of 3044	2420	c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exe	n1CFTmo49jQLRYI.exe
PID 2420 wrote to memory of 3044	2420	c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exe	n1CFTmo49jQLRYI.exe
PID 2420 wrote to memory of 3044	2420	c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exe	n1CFTmo49jQLRYI.exe
PID 3044 wrote to memory of 5044	3044	n1CFTmo49jQLRYI.exe	regsvr32.exe
PID 3044 wrote to memory of 5044	3044	n1CFTmo49jQLRYI.exe	regsvr32.exe
PID 3044 wrote to memory of 5044	3044	n1CFTmo49jQLRYI.exe	regsvr32.exe
PID 5044 wrote to memory of 5048	5044	regsvr32.exe	regsvr32.exe
PID 5044 wrote to memory of 5048	5044	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exe
"C:\Users\Admin\AppData\Local\Temp\c017d23c2f5be66bd0e0828d047a8f604b8071c38b5c79c317bf89aee954f31d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\n1CFTmo49jQLRYI.exe
.\n1CFTmo49jQLRYI.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:5048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.dat
Filesize
6KB

MD5
379e19687809e6330051e539ac11accc

SHA1
a86cdddb0970a0ffbe948e5c86030e2336921bf9

SHA256
f2d3a157b43a33723390e8bc80b6f7584115e8a09051da9704481369f303e384

SHA512
98918d7ffee91a01f29af74d199817e8857d3b5e0fc601d800638bdb7852590f2514fab56e895e562e5d30c5978a6f22a369704eaf92f82500000068a962094c

Download Submit
C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.dll
Filesize
747KB

MD5
568f45a778978bfa4c7b3bd0c6a5dbf3

SHA1
2bf9ff26b5c38630b42d932506905725ef3a04a6

SHA256
a914e0ec45c799c86c4f62d4144ab5b9c9ded0ad33461fb41de8a437ce00196d

SHA512
62727e134832a741b10260a50a3f0ea68dece7e8f22afc29b937c10a84b3d6fbd23f36b8a1ff83bfa804a7fa18482671d25a9e94b77820c64f33bd66a95f2fca

Download Submit
C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Program Files (x86)\GoSave\8oS5YzBSvzavqT.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\8oS5YzBSvzavqT.dll
Filesize
747KB

MD5
568f45a778978bfa4c7b3bd0c6a5dbf3

SHA1
2bf9ff26b5c38630b42d932506905725ef3a04a6

SHA256
a914e0ec45c799c86c4f62d4144ab5b9c9ded0ad33461fb41de8a437ce00196d

SHA512
62727e134832a741b10260a50a3f0ea68dece7e8f22afc29b937c10a84b3d6fbd23f36b8a1ff83bfa804a7fa18482671d25a9e94b77820c64f33bd66a95f2fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\8oS5YzBSvzavqT.tlb
Filesize
3KB

MD5
09f02d57c684e89e594215260e2323b4

SHA1
c66c408e4919d9466f0b079846658165fd5daf11

SHA256
e4cdffe72ccc82e3dc738b78bc1aa4646ef9f9451662b0de6d67e18067837383

SHA512
f44be8c55204e41ade8c71d837cfe6d21fc9e708fdeb1b40433b4b893287f11006835ff1361e81de42f9cf03e0783269169e7ec920ea6b4f369f2dd648febdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\8oS5YzBSvzavqT.x64.dll
Filesize
875KB

MD5
17da2bf78af676b649eae4f74864dfcc

SHA1
decf265a0aadc130874511ace40c62b0c0e16aac

SHA256
b3a707a96ccf454e91ecc1c8578928232646f188b7d9973678f0e27bbf96a2fb

SHA512
76522bd652d3ed0d6bec2c467937e319c24040498f825a2e5dec3c18357c5548a37b3d99de1f748ffdc380ae36b502ec0a6761f2adb55ffbbab1972323a3e806

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\aimjmgkhdkbgpcimgjanikodhndihhji\TslmPg.js
Filesize
5KB

MD5
30414dc4501cede07488b62eea35ba7f

SHA1
63fb9aa2315070e32d1149dfda8eda5e0622945a

SHA256
1988e6ea1dce575c5a863fdc6efdf07a2c4b4a5bf558aae61a721b0234b0da10

SHA512
6da6c52667e21613c1e5a0835b57c4ee69843870c16db2346f70c27c6f0f79914e79a538c0dd15073eda3cbc202afbde6af13f006cf39d45425ec5319b841e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\aimjmgkhdkbgpcimgjanikodhndihhji\background.html
Filesize
143B

MD5
214ba8cb3e60d11f465225cbb78583b3

SHA1
af56a8ee6350ef826c656995ba3c335337aaf192

SHA256
aea08a765bfcf52e4767ce47e307f70628d559340602779b9d2e4d44fec06e78

SHA512
10226132c7c3586dd63bd628870eec7a8a193355414846b8efca7c2f3aa765500668db5f9e2b75ed3504639ec8e01742d22ecbaf4af839114307bc0c1924fc92

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\aimjmgkhdkbgpcimgjanikodhndihhji\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\aimjmgkhdkbgpcimgjanikodhndihhji\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\aimjmgkhdkbgpcimgjanikodhndihhji\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\n1CFTmo49jQLRYI.dat
Filesize
6KB

MD5
379e19687809e6330051e539ac11accc

SHA1
a86cdddb0970a0ffbe948e5c86030e2336921bf9

SHA256
f2d3a157b43a33723390e8bc80b6f7584115e8a09051da9704481369f303e384

SHA512
98918d7ffee91a01f29af74d199817e8857d3b5e0fc601d800638bdb7852590f2514fab56e895e562e5d30c5978a6f22a369704eaf92f82500000068a962094c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\n1CFTmo49jQLRYI.exe
Filesize
785KB

MD5
c452103272f13b87cdbecb41ae8c5e15

SHA1
3904c76d43842139288db38322ae2522f69b0f47

SHA256
95494f4ea7ec3895ab6b670e91e3f99489d4ac84e54bb652bda11f1d539c5a30

SHA512
f20683111d6cc0dc72de592e74d101a30af835bd32d4a70ad00fb9f2b5cc42081e6c942477dba8bb294ee0aadedf1e3b335bb982b5613ae550987f10f84273a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\n1CFTmo49jQLRYI.exe
Filesize
785KB

MD5
c452103272f13b87cdbecb41ae8c5e15

SHA1
3904c76d43842139288db38322ae2522f69b0f47

SHA256
95494f4ea7ec3895ab6b670e91e3f99489d4ac84e54bb652bda11f1d539c5a30

SHA512
f20683111d6cc0dc72de592e74d101a30af835bd32d4a70ad00fb9f2b5cc42081e6c942477dba8bb294ee0aadedf1e3b335bb982b5613ae550987f10f84273a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
218fd2311d986982be310fa4397b89c9

SHA1
f7867f5dbe8f2c5fc4990fe4d452d0f341502bae

SHA256
1c5f35866649dd2b4f74334505acd22d00a30b94c7df1ad04f495052bb38da7b

SHA512
70c3415a7d36d3d7a78268eb2a88375d561461c6bb4f1ac57d7b5a517adcc7946e0e31a2adbe798065982e4ea349e1490d720bd1d8c4f15628f8549f1cbb13b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\[email protected]\content\bg.js
Filesize
7KB

MD5
2c08621a516ed008d4c33a25acca3337

SHA1
99aa5e61f1e98d8e97259502850cdea866470077

SHA256
9e46216559db32d5a642ab7d0d2ccc9a0c73c673247d54f0c24255d4697b6280

SHA512
25c88dce32762c002627cba56fe17e98d3508bd9253e025c95d816ce31a374069f9222535e6afecef44fe98cf160e0a4b74e6070045dd4cf6a85b561b629bff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD8B1.tmp\[email protected]\install.rdf
Filesize
597B

MD5
646bff897dc44bf88061f71b1ef05466

SHA1
6cc3378f7ae8a9746591d53c3bf12f841f560fa1

SHA256
7574b6307398045f6cdfc473a9f4c7409fa90f19cc60325e1c885119a1e1d27a

SHA512
1ff2cc438a34c83a2d8a78b0ca358e19d62d00f004fdb368817e08aa927752a331612436f41dda264cc7e0a6c5e34c51333cae348cd518f94dea36f64b94cef5

Download Submit
memory/3044-132-0x0000000000000000-mapping.dmp

Download
memory/5044-149-0x0000000000000000-mapping.dmp

Download
memory/5048-152-0x0000000000000000-mapping.dmp

Download