a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd

Analysis

max time kernel
195s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe
Size

919KB
MD5

9b73014d87dccc56daade82dd2b9184a
SHA1

db50ddcc857e1c3f31ae8afaff815dd1e253dde6
SHA256

a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd
SHA512

f805c9920ee693dd21fa6da896bf7aa375363a66277a3bcebe8fc8dd4a0dbaa0d736670aa6d4fa0e238c153e930c5b27ee314c87311463ff4ce3ba6076e5c3d5
SSDEEP

24576:h1OYdaOSMtdHAqcdDVhYwiei7+EpFAh/kKx:h1OsnPHVmVhYwiLtKkKx

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WtQgLMCAT27rTvR.exe

pid process

3500 WtQgLMCAT27rTvR.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

WtQgLMCAT27rTvR.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoghiikpajmojjmpfalkdmlcplliocba\2.0\manifest.json	WtQgLMCAT27rTvR.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoghiikpajmojjmpfalkdmlcplliocba\2.0\manifest.json	WtQgLMCAT27rTvR.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoghiikpajmojjmpfalkdmlcplliocba\2.0\manifest.json	WtQgLMCAT27rTvR.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoghiikpajmojjmpfalkdmlcplliocba\2.0\manifest.json	WtQgLMCAT27rTvR.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoghiikpajmojjmpfalkdmlcplliocba\2.0\manifest.json	WtQgLMCAT27rTvR.exe

Drops file in System32 directory 4 IoCs

Processes:

WtQgLMCAT27rTvR.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	WtQgLMCAT27rTvR.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	WtQgLMCAT27rTvR.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	WtQgLMCAT27rTvR.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	WtQgLMCAT27rTvR.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

WtQgLMCAT27rTvR.exe

pid	process
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe
3500	WtQgLMCAT27rTvR.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

WtQgLMCAT27rTvR.exe

description	pid	process
Token: SeDebugPrivilege	3500	WtQgLMCAT27rTvR.exe
Token: SeDebugPrivilege	3500	WtQgLMCAT27rTvR.exe
Token: SeDebugPrivilege	3500	WtQgLMCAT27rTvR.exe
Token: SeDebugPrivilege	3500	WtQgLMCAT27rTvR.exe
Token: SeDebugPrivilege	3500	WtQgLMCAT27rTvR.exe
Token: SeDebugPrivilege	3500	WtQgLMCAT27rTvR.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe

description	pid	process	target process
PID 3492 wrote to memory of 3500	3492	a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe	WtQgLMCAT27rTvR.exe
PID 3492 wrote to memory of 3500	3492	a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe	WtQgLMCAT27rTvR.exe
PID 3492 wrote to memory of 3500	3492	a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe	WtQgLMCAT27rTvR.exe

C:\Users\Admin\AppData\Local\Temp\a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe
"C:\Users\Admin\AppData\Local\Temp\a6620644a360a744a446d44e9ec9456ae0f9abf251f51c7e846c936f8a935dbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\WtQgLMCAT27rTvR.exe
.\WtQgLMCAT27rTvR.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\WtQgLMCAT27rTvR.dat
Filesize
1KB

MD5
b99ca38fcd69f4fb6854742e9d46d48c

SHA1
9f80153d1e1f3f424c86fdda310287c600a2261f

SHA256
ec8a5b2f0504bcd59714c399fea652582c38b38fe542de3f94262a4acb46f18f

SHA512
9c69ce1cc5d393f4decf12d2a2618a9f4f2a33c9cd90bd5082eb464a3b22832c083139db8e9c2a13f899dd36ef1717e28c89dcfd3a75631579dfcbff8e0f9c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\WtQgLMCAT27rTvR.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\WtQgLMCAT27rTvR.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\eoghiikpajmojjmpfalkdmlcplliocba\EdyZpW8WGo.js
Filesize
6KB

MD5
7c75bfe7273ce9f50f52c02f8ca65f46

SHA1
ee442a8175c38b11a7b865eab36cf39846e0a56f

SHA256
1e1acb768b52efdd7e27613f05afb1ce751ecdfcd3ed3b7e040730891b2005a6

SHA512
5532ab6f03216fd7b886b1ad3d37ab4601ff920ecc8f14e45c804f9be0929c3395c383e49c9a0dfabbb9a935731c5adfc6d179e50e72fb1d47b4604470bbe3c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\eoghiikpajmojjmpfalkdmlcplliocba\background.html
Filesize
147B

MD5
e5dd95471fcf3f361ec377836d1e8281

SHA1
7d56aafd17e8ec7e2eebb56ade3f8ba55b8f5bdf

SHA256
d8bb64c0759cffdd7a4fe7f1ef96f382c443fc639b5fe549694d53bd28ebc355

SHA512
0fe5a618463635d40b3273f625f03c28838daa62ac2e0d5545a20d4092b10dd9671d75bad36fcec569a56f7a7fd9acea3ea53a2a74892c0d8c092a0f89c3b26b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\eoghiikpajmojjmpfalkdmlcplliocba\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\eoghiikpajmojjmpfalkdmlcplliocba\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\eoghiikpajmojjmpfalkdmlcplliocba\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
e448b3d43c4e11b1b5ffdeff3231b182

SHA1
772bbec246bf08aca5708351d686341319238aec

SHA256
fa457039528d978e2660090445fbb829824303bc4104defafa97ef5739a4854e

SHA512
c8683f33dd330fb9cc2f2566f3a52894591ed14c6d5fb222c9c070974949eff60734244bc070f92f46ae210a4198e4c2854bdb2537460470d736aafdb483bd29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
67818c769bc1a7c32a7456ff8c90ad54

SHA1
6be060dda1208d1947450220602a81101067b321

SHA256
2aec73710a40379ef163b5c6c73f6945370dd8e9cdcaf18df1fc89025eebc8f7

SHA512
9a6a14638d152a8f5c3a4815b15780d168403def69c10941455456a8ba42736dd26d09436605e0bf24201533e7bc6fabc01ab3a1b083bd2ccab45130546f74bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS51D9.tmp\[email protected]\install.rdf
Filesize
592B

MD5
232c529e3f88a57f3a21fa9c19140c81

SHA1
2ac2575ab6dbf781375341621b57eeb4422b9f21

SHA256
3d213ae0298e7a7ee624f157517bcdf06760f80344abd8b01c005d8e6b78b6bf

SHA512
e55337c6b0dde0317dc22bd25a73778907117a0747360ed1dd468f8116a1f358f1c82ab4e4f1caa15c2fa44ae2ac21945d7e61fdc8a741bc0b7417bf422a7bd5

Download Submit
memory/3500-132-0x0000000000000000-mapping.dmp

Download