Analysis
-
max time kernel
454s -
max time network
482s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:48
Static task
static1
Behavioral task
behavioral1
Sample
c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe
Resource
win7-20220812-en
General
-
Target
c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe
-
Size
2.5MB
-
MD5
1400928994f84ba4ba3a5b2b2c212b2c
-
SHA1
10325cf989b6142dd1eb6653793e2b3ced2bd665
-
SHA256
c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896
-
SHA512
24b5aa7a38268465a7b6071904790e40c5bb8407f3eca467eeed0be545bc574962f1d1df7cfef032b308325e099ff23a1ebe21fe8f6311a40b13d7189f451cac
-
SSDEEP
49152:h1OsoyDFXmj+BHBALGk7GNIgSDjjQkzYznJKOZaB/IsxY:h1Od0JSqALGkqaDj7Y
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
SZ3v5EhvKb0LvpL.exepid process 2780 SZ3v5EhvKb0LvpL.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 5 IoCs
Processes:
SZ3v5EhvKb0LvpL.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nijcbdhklnbdjacnmijbdklhnjgekpjo\1.0\manifest.json SZ3v5EhvKb0LvpL.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nijcbdhklnbdjacnmijbdklhnjgekpjo\1.0\manifest.json SZ3v5EhvKb0LvpL.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nijcbdhklnbdjacnmijbdklhnjgekpjo\1.0\manifest.json SZ3v5EhvKb0LvpL.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nijcbdhklnbdjacnmijbdklhnjgekpjo\1.0\manifest.json SZ3v5EhvKb0LvpL.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nijcbdhklnbdjacnmijbdklhnjgekpjo\1.0\manifest.json SZ3v5EhvKb0LvpL.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SZ3v5EhvKb0LvpL.exepid process 2780 SZ3v5EhvKb0LvpL.exe 2780 SZ3v5EhvKb0LvpL.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exedescription pid process target process PID 1084 wrote to memory of 2780 1084 c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe SZ3v5EhvKb0LvpL.exe PID 1084 wrote to memory of 2780 1084 c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe SZ3v5EhvKb0LvpL.exe PID 1084 wrote to memory of 2780 1084 c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe SZ3v5EhvKb0LvpL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe"C:\Users\Admin\AppData\Local\Temp\c0817f3dc80d3f693f5d7280d30ed7f7fcf8087aee715982a1f9fc259b681896.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\SZ3v5EhvKb0LvpL.exe.\SZ3v5EhvKb0LvpL.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
PID:2780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\SZ3v5EhvKb0LvpL.datFilesize
6KB
MD5aa9ee923ba3c449442c06bb52b045757
SHA1e3befe5dbb00f1e8f6773ffe7e73dd7433cad2e1
SHA2561035aae9f414a1eb4ddbfdc982bea0f494b2bd5517d2c19f4f408decdba7d985
SHA51218824cf6cf0932a41c7ebf5c2027e7dd569084784ef7e118be94d0261a5c7ae4e4bb826d42993c2c5d941af85a18f6956e693cc008929f115bbf5dffd07397c7
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\SZ3v5EhvKb0LvpL.exeFilesize
769KB
MD5926d03f373e2f0d6ecf16e30c941ad60
SHA1b5caf80c04b62525774f66262ce6b1ebeaa19315
SHA256b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847
SHA5126aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\SZ3v5EhvKb0LvpL.exeFilesize
769KB
MD5926d03f373e2f0d6ecf16e30c941ad60
SHA1b5caf80c04b62525774f66262ce6b1ebeaa19315
SHA256b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847
SHA5126aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\nijcbdhklnbdjacnmijbdklhnjgekpjo\aa07nqg.jsFilesize
5KB
MD5fe92f391f09100b89a492fa0abce4f24
SHA17574bcdcd635904dbca18c44c286426cf3c9401b
SHA2563972f29323c516cb3bc161849ef7f03db2eef8a09a4ae20c8dd1153f6110cce1
SHA5122a40ee1034e998751c831700573b98c71b03aa77651d0401c05580a72c2fb30ffb0d7fab81f04bf19f2e1299405b7d66c2bee8c6fa90adb5503c4cbe5e450b5a
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\nijcbdhklnbdjacnmijbdklhnjgekpjo\background.htmlFilesize
144B
MD5a71e3bbcc2d9b1eb50df015a0232702c
SHA146a07b0d9c63450e3a6498799b583795bde9eb2c
SHA2566c37ff2020d06c3c0cdf3bed6e14e29c1b95ad94db8733032756885fb06969fd
SHA5123ddb4dcd2025cbae010558ef6726ca066c1846e8fe49a30e543b6e53cbd5d863cd0d17e4bbe53b5398ee10d12d219c375583367844b40998abcfa422c8f23629
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\nijcbdhklnbdjacnmijbdklhnjgekpjo\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\nijcbdhklnbdjacnmijbdklhnjgekpjo\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS3A51.tmp\nijcbdhklnbdjacnmijbdklhnjgekpjo\manifest.jsonFilesize
507B
MD5d429395a45a9aa09e4ee9054e9196b30
SHA1c5dbab4e27650b07d4d159c305d08a9d578c3a3e
SHA256674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344
SHA5124a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e
-
memory/2780-132-0x0000000000000000-mapping.dmp