c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe
Size

932KB
MD5

89bf9fbefde3f88fbb9787df4c1b3f6b
SHA1

0cac7e8f27f04620dbea4c5360fe515cca926b20
SHA256

c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35
SHA512

526431cf6bc6a4986bbfd4aebd06b0c2cf488a9d03a17dbea444a85be9aa33bcc44ae00a53b10bba5d615fd0227c77685a432f8ebd2a1cf448fc36f9e59a411f
SSDEEP

24576:h1OYdaO+CZ/iWCvu/2sWsJA/jlt+DHhsI:h1OsICpYO/dJJDHhsI

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

f4toM1a1AUYHye8.exe

pid process

1372 f4toM1a1AUYHye8.exe
Loads dropped DLL 1 IoCs

Processes:

c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe

pid process

1208 c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1208	c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe

Drops Chrome extension 3 IoCs

Processes:

f4toM1a1AUYHye8.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlhaljphcdnapkhplkgcdpojbcoembmb\2.0\manifest.json	f4toM1a1AUYHye8.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlhaljphcdnapkhplkgcdpojbcoembmb\2.0\manifest.json	f4toM1a1AUYHye8.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlhaljphcdnapkhplkgcdpojbcoembmb\2.0\manifest.json	f4toM1a1AUYHye8.exe

Drops file in System32 directory 4 IoCs

Processes:

f4toM1a1AUYHye8.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	f4toM1a1AUYHye8.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	f4toM1a1AUYHye8.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	f4toM1a1AUYHye8.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	f4toM1a1AUYHye8.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

f4toM1a1AUYHye8.exe

pid	process
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe
1372	f4toM1a1AUYHye8.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

f4toM1a1AUYHye8.exe

description	pid	process
Token: SeDebugPrivilege	1372	f4toM1a1AUYHye8.exe
Token: SeDebugPrivilege	1372	f4toM1a1AUYHye8.exe
Token: SeDebugPrivilege	1372	f4toM1a1AUYHye8.exe
Token: SeDebugPrivilege	1372	f4toM1a1AUYHye8.exe
Token: SeDebugPrivilege	1372	f4toM1a1AUYHye8.exe
Token: SeDebugPrivilege	1372	f4toM1a1AUYHye8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe

description	pid	process	target process
PID 1208 wrote to memory of 1372	1208	c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe	f4toM1a1AUYHye8.exe
PID 1208 wrote to memory of 1372	1208	c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe	f4toM1a1AUYHye8.exe
PID 1208 wrote to memory of 1372	1208	c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe	f4toM1a1AUYHye8.exe
PID 1208 wrote to memory of 1372	1208	c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe	f4toM1a1AUYHye8.exe

C:\Users\Admin\AppData\Local\Temp\c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe
"C:\Users\Admin\AppData\Local\Temp\c0688cbe4b8ebcab5e63cbed993ed9d39a692662d415cd248ecb13219d8abf35.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\f4toM1a1AUYHye8.exe
.\f4toM1a1AUYHye8.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\f4toM1a1AUYHye8.dat
Filesize
1KB

MD5
9c772ed14b5b3b0b2a5f45a52717e366

SHA1
e5f22a86bf6e691abf5eaf0d7be8879d2477f30a

SHA256
581221d93edc4788afa67e47f75bb719f83dca4f2c966b4a9283792b663578d5

SHA512
ed5e8554faeafabab039b1d9422c2a9b2d69d37790546a8acf1e0505919e66e005e93621cc07f7db6185adf04edf3819c6c44841f48d8b94121758b32ad14521

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\f4toM1a1AUYHye8.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\hlhaljphcdnapkhplkgcdpojbcoembmb\background.html
Filesize
141B

MD5
32225ff80cf23419aef37b62e09f066f

SHA1
a39cc113b63b1b9df761746e685331a7f27a0501

SHA256
fc85d2ab580a346787f3d426a10bc112a1326b8faf680b8f065e585cda4782a9

SHA512
045b12ae5b0df2934e92a4cb49b1646d57fb68e31da3624772c16a8366c6cc7c06096e215569468e56124061221077e9a2e311c9fef5cf5932c425c72de45028

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\hlhaljphcdnapkhplkgcdpojbcoembmb\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\hlhaljphcdnapkhplkgcdpojbcoembmb\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\hlhaljphcdnapkhplkgcdpojbcoembmb\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\hlhaljphcdnapkhplkgcdpojbcoembmb\yraN.js
Filesize
6KB

MD5
eb895175d912588240f61a0d9ca503eb

SHA1
aa7cd534ce458b3e1051cd8245f6afc15022bd37

SHA256
21f4ea852762a16c6bb135c43af9262c6af1299bac5a07a57d4adcce7c351b8f

SHA512
c5663dae42505d865afb49caf60427af20627f713f270548cf451ca03c7c91a4c47caa690435434f625f392e8a9cb49a30bef0f3da69c4eab2b0a36477637eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
9d69627662f3faf20abac9f9cb5ee559

SHA1
51e46496b5a09c4faf4c2b4bc953e7cc7031e0ee

SHA256
ec393e7878d1a47f03a174a599f6d1e8cb669cf740b5e157e8d59739c729f13b

SHA512
b0bb21c8440e2ff2f64dd1752f4dd5f10fb4f468f8b3968a515b2edf638cc4706a80f4423b6e742a74c9f5a2bcd92c2e50886b8eeed959a901207a71c32aa312

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
a2577c3a92864f1a1458014ebf5b3bdc

SHA1
77fa35fa812c3eb7cd283c5f3dc76024f636413a

SHA256
8d3ab02226093eb1a8782572074181e0ab67b738d90eb31a592b37d79cdc463c

SHA512
471cd8600eecea2dfd5e6309a3694532bf793a44347774faa15f0a9726dfb9580311b4555db9655e7734fcb1c3620ad022544708d8b87e42de72c585fef56d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\[email protected]\install.rdf
Filesize
597B

MD5
51c6c9e8c38b3aa0e8fea710501fe8c7

SHA1
c70480c3294d991ae78f62cfe42861dc69973c64

SHA256
8ce2387534305dba1476da5fac1e2d4c36a303032101163e6a430d692e8df7e6

SHA512
114b8bdedb51113ffd16a8f31af193cad459020c20bbc6c40239c60ad022642ed2a27fe0216b9ba652741c3e017bf9914fb3cfd28cac284af31745b3e1f08d65

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3F14.tmp\f4toM1a1AUYHye8.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1208-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads