Analysis

  • max time kernel
    8s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 21:10

General

  • Target

    a700204b58ea85c3cb8d00b54ea4ef2785e4dddb2819f67c397f50a4f350c418.exe

  • Size

    919KB

  • MD5

    0d9014578407081ab6310cb69202662a

  • SHA1

    3182f9c05cf37b0035a7abab2ab518eed08147bd

  • SHA256

    a700204b58ea85c3cb8d00b54ea4ef2785e4dddb2819f67c397f50a4f350c418

  • SHA512

    1df38c5a8810054b31827e2a52c1f52143982ba5d8796f9e53c26ca124dbca9551df861fc81c2bbf0bad1835e1a6ca4189e8981ba1f1027d29f12a0d73046150

  • SSDEEP

    24576:h1OYdaOZMtdHAqcdDVhYwiei7+EpFAh/kKm:h1OscPHVmVhYwiLtKkKm

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a700204b58ea85c3cb8d00b54ea4ef2785e4dddb2819f67c397f50a4f350c418.exe
    "C:\Users\Admin\AppData\Local\Temp\a700204b58ea85c3cb8d00b54ea4ef2785e4dddb2819f67c397f50a4f350c418.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\MbINr6l2j3t3Njd.exe
      .\MbINr6l2j3t3Njd.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2004

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    2d05e9812710433549e6382d1c23cf91

    SHA1

    de5e5207fd7d65d87fa5b11aa54277c531e5a1bf

    SHA256

    57c3478e9649bef5f275c23433b09e4ee8fd9668e308782942bf72a99bafcd38

    SHA512

    efa722520f9eb8b2b2876b7d45bdd96d604118e49feab1a2c956f0ceed7c74e2edbc9404d9fc7b3d05c538dd0b8c45807ee7bcba06d6d3e64e8f6ff06f42a764

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\[email protected]\content\bg.js

    Filesize

    8KB

    MD5

    db7df5e737d4fe22f3bf0d9dd538087b

    SHA1

    b8a896239a607b0a1045829d951d1051970e726f

    SHA256

    08e343442a2f729bd522324bebcdd02fd92c138179214f84822345a80c6c5862

    SHA512

    a95c60d7c3faeb8b55982f7998c2b9b75e50d602d63ef4be396ec2998013673c8cb580614622334f72bb91b0bfe32fbd43fdcdc01fd4d60c8b821e12e1f91eb1

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\[email protected]\install.rdf

    Filesize

    595B

    MD5

    b6b20fb80f3711758b8dcb033093d3d3

    SHA1

    36bc13fff945baf5332515f516b88142a3f3a07b

    SHA256

    eb625266d491905fa1baa7df30000ad2dd836b5321e2b900d6f19507e9c6cb01

    SHA512

    efdfb33d8c3c9cc3fc4f1521b12a77df5430d65d9ecb7a9c744b3ccae3dcb9399678322ffc0bb600ed83e4bc979bb21d7c42ad5fb43263fa9d89ad99a4ffa6d1

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\MbINr6l2j3t3Njd.dat

    Filesize

    1KB

    MD5

    1270b2e6427c424545d7e61043bf941d

    SHA1

    719381de739f01d3835391d19949e8de92d17f2f

    SHA256

    62167dfeb8dbc1044522e79fb33f220d36255f74de3ce383fe339e71022b53d5

    SHA512

    dd685691b6922994536bb4236b7623f68423d0a839141eaf3b34303d47e6b0ac5b19c3afaa8ea703558301c7911dfc5b0f8d974b128e78000d10d0eec3ba98b7

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\MbINr6l2j3t3Njd.exe

    Filesize

    760KB

    MD5

    dcd148f6f3af3e3b0935c4fcc9f41811

    SHA1

    ee9bdbc7c568c7832d90b85921ab20030b6734cd

    SHA256

    f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

    SHA512

    34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\clhdfnifdilpjbmgeipfkmlabnmglbba\Ii5Xy3P1k0.js

    Filesize

    6KB

    MD5

    a31b049cfdb8597ad1692cbb0cb55936

    SHA1

    29c0a1ee2fa8998145f3e546fb65863ee66d29f6

    SHA256

    7f3e8a963f3a36a0b79eba73e962beb925bd81adfe6e9a7d82e9be001ca87a83

    SHA512

    98fea6ba83b9b1b1a2b8ee0f468dd78ecd7c9af8f943ddd9a97a41f1f01094c6f274693484ae0aba84b773b12e9ba6eebe26e4eef3b7053bacde03961687ac83

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\clhdfnifdilpjbmgeipfkmlabnmglbba\background.html

    Filesize

    147B

    MD5

    db0e0d14846afc6da25fac354babf8b6

    SHA1

    21107f25da5e4022f7ebc82ac8fd8a039f1b076f

    SHA256

    e0ae2acb26c4fa8b08aba51eafbd2490df1e2833c20374f2f7ac947814c63954

    SHA512

    10678866e88b6ca23f006e4566a9d8ee827c87ced4b43987b39d16e40849726021cbd2813786447c6a6dd73976571be617853f9ca30add1e891643cc5d9d8651

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\clhdfnifdilpjbmgeipfkmlabnmglbba\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\clhdfnifdilpjbmgeipfkmlabnmglbba\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSA046.tmp\clhdfnifdilpjbmgeipfkmlabnmglbba\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • \Users\Admin\AppData\Local\Temp\7zSA046.tmp\MbINr6l2j3t3Njd.exe

    Filesize

    760KB

    MD5

    dcd148f6f3af3e3b0935c4fcc9f41811

    SHA1

    ee9bdbc7c568c7832d90b85921ab20030b6734cd

    SHA256

    f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

    SHA512

    34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

  • memory/1808-54-0x0000000075511000-0x0000000075513000-memory.dmp

    Filesize

    8KB

  • memory/2004-56-0x0000000000000000-mapping.dmp