Analysis
-
max time kernel
270s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:15
Static task
static1
Behavioral task
behavioral1
Sample
a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe
Resource
win7-20221111-en
General
-
Target
a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe
-
Size
2.5MB
-
MD5
68160fe3148de6c4b457b9ff7548d023
-
SHA1
f3bcedc72b3caf505c0aff1a13b9afcdd1d8b168
-
SHA256
a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc
-
SHA512
1756e4a28532c1067017c445b7094e867ebc76be80ce37f67df5d285943fc673962f298c7aa43a871e20b40423a423f4c450af43b91224ad292596175559e8c8
-
SSDEEP
49152:h1OsG+CUVCan0ytkbv/uiAY2QipuqOXMzsivHHOHNRcb8N:h1Ot+Yan0v+QAuqOXQBv8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Tw1fgF7OZes8kyt.exepid process 1088 Tw1fgF7OZes8kyt.exe -
Loads dropped DLL 1 IoCs
Processes:
Tw1fgF7OZes8kyt.exepid process 1088 Tw1fgF7OZes8kyt.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 5 IoCs
Processes:
Tw1fgF7OZes8kyt.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjmhhkhebjokmaacjcgbhbnjfagcckkl\2.0\manifest.json Tw1fgF7OZes8kyt.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjmhhkhebjokmaacjcgbhbnjfagcckkl\2.0\manifest.json Tw1fgF7OZes8kyt.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjmhhkhebjokmaacjcgbhbnjfagcckkl\2.0\manifest.json Tw1fgF7OZes8kyt.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjmhhkhebjokmaacjcgbhbnjfagcckkl\2.0\manifest.json Tw1fgF7OZes8kyt.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjmhhkhebjokmaacjcgbhbnjfagcckkl\2.0\manifest.json Tw1fgF7OZes8kyt.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
Tw1fgF7OZes8kyt.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects Tw1fgF7OZes8kyt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ Tw1fgF7OZes8kyt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} Tw1fgF7OZes8kyt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} Tw1fgF7OZes8kyt.exe -
Drops file in Program Files directory 8 IoCs
Processes:
Tw1fgF7OZes8kyt.exedescription ioc process File opened for modification C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.x64.dll Tw1fgF7OZes8kyt.exe File created C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.dll Tw1fgF7OZes8kyt.exe File opened for modification C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.dll Tw1fgF7OZes8kyt.exe File created C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.tlb Tw1fgF7OZes8kyt.exe File opened for modification C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.tlb Tw1fgF7OZes8kyt.exe File created C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.dat Tw1fgF7OZes8kyt.exe File opened for modification C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.dat Tw1fgF7OZes8kyt.exe File created C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.x64.dll Tw1fgF7OZes8kyt.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Tw1fgF7OZes8kyt.exepid process 1088 Tw1fgF7OZes8kyt.exe 1088 Tw1fgF7OZes8kyt.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exeTw1fgF7OZes8kyt.exedescription pid process target process PID 4588 wrote to memory of 1088 4588 a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe Tw1fgF7OZes8kyt.exe PID 4588 wrote to memory of 1088 4588 a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe Tw1fgF7OZes8kyt.exe PID 4588 wrote to memory of 1088 4588 a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe Tw1fgF7OZes8kyt.exe PID 1088 wrote to memory of 4824 1088 Tw1fgF7OZes8kyt.exe regsvr32.exe PID 1088 wrote to memory of 4824 1088 Tw1fgF7OZes8kyt.exe regsvr32.exe PID 1088 wrote to memory of 4824 1088 Tw1fgF7OZes8kyt.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe"C:\Users\Admin\AppData\Local\Temp\a537929cebf4db4c8419a271b2958985ac321948b6f7e0e29241b9f37b0536cc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\Tw1fgF7OZes8kyt.exe.\Tw1fgF7OZes8kyt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.x64.dll"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\SS7D33d5mZHE3Z.dllFilesize
749KB
MD5a8100741ab8af6097247f445cee85e1c
SHA1e8febe07d4454e884c7dda60a6310a822cac340e
SHA256893e0c1e415f5375c78b0e15020d7f70aa99c90ca439d41c57c078d1835f7f0a
SHA5123ed9740fc2f1b2943816a5785543cfda403b63fd1260df1c8ba5ec9627866c682706fd644f2daf4ee688986f25b7ee8ae56b39f2842bd837059fbfdfd5024762
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\[email protected]\chrome.manifestFilesize
35B
MD556b3f905c51947534a93604e23dfd27d
SHA1e18a4b3190bbd509bc222b1f24a89b4f475114b6
SHA2565d24748e9f3a5dd2240a4d1c47eb1e4bab9ead0f395e5254007349036b61c073
SHA512859689c50ec626d772b60ef8b6eb82072ef2d0c7f51d0a0cc269bd901e60b79d24511dbfb5e6493c2b293c3eece0dbe8c5d76f908d393653209e1a69f92e6f03
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\[email protected]\content\bg.jsFilesize
7KB
MD534c7cc4506067c1e1bbc9f3f8bd1a5d5
SHA14096d7c255822e41637a409d9abe2b244b4f968e
SHA256db8b5988fa8058ca3557d2177b922c7dca9e59cb9c94e87c1751f9f27a0e78b0
SHA512e195b33a289d47644e9c2a4712d76ac7cdab2422fa50068865540c29aa1e77590219fa4a190e15ac8c295b2fe9e23bcaa6167173daedd10f37ed746bfceb732f
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\[email protected]\install.rdfFilesize
596B
MD5c03c4a0916fcc4478485f12854d1ab4a
SHA17b2b705a2a726784dcb463cef8e40cef5f188756
SHA2562699cca42a0e5ae0963169efd376e1d53b7b816a166b3939e7649ea8bfdcb46a
SHA512b054a838db321e4f00f490c1cd71c76859abce955eeb7afc46db81599b22b332194373590394dc29d90ecbffb06672925aa650c377af794c44c3d9d5d2ff8ce4
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\SS7D33d5mZHE3Z.dllFilesize
749KB
MD5a8100741ab8af6097247f445cee85e1c
SHA1e8febe07d4454e884c7dda60a6310a822cac340e
SHA256893e0c1e415f5375c78b0e15020d7f70aa99c90ca439d41c57c078d1835f7f0a
SHA5123ed9740fc2f1b2943816a5785543cfda403b63fd1260df1c8ba5ec9627866c682706fd644f2daf4ee688986f25b7ee8ae56b39f2842bd837059fbfdfd5024762
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\SS7D33d5mZHE3Z.tlbFilesize
3KB
MD555036102fbe33fe4808fee8da37dfd2e
SHA16a3b76d89c42818189d05b37d9571be4b8f6b6b5
SHA256a80428e48783d869c7463688ceca06b79af826ebd208b5d10a716c88b804f18b
SHA5126da5713c4f07c38a49a4c93324365e1801b44f239444c29285ce68e9d11568449d871078edd58092b1670401bda34e424adf4d3671d10859f7351d9d45b7c272
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\SS7D33d5mZHE3Z.x64.dllFilesize
881KB
MD5bbec1f94c849ac4b361307420ccdc7ca
SHA1bf13082a49dccc2aeb426965a755c981b3a6f87c
SHA256803647055a99148674a80d8b791bbf4aec502bc85aa9a579b6a0a80ca8f0de35
SHA512e0ec8717d067ca73cc0bdd0cf812f568e9c5dcd8aeb64bff00232330a46b0a16b93074cc035a93634afebf639cb9a1155c197701a9809a590af227a467d83611
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\Tw1fgF7OZes8kyt.datFilesize
6KB
MD58da88fa3a672b7cb5cca3a2e180d7656
SHA152f27b45caf8867ed3827a7caaf8eae01264c559
SHA256903fc5d996f2f9b11416fdec5d443d2612fb733362b0243188b7b9b4750765c2
SHA512221e94ce5fb2f17e88eb674f6b7d914547947578d03ba994fe5d84841006672ed2dd9db346435b1bf8a967305a3f3025e5ef446cf08ae07760d1d73da2a14b09
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\Tw1fgF7OZes8kyt.exeFilesize
770KB
MD5a82d1b7ae1c33f81f672f8854ffccd3f
SHA1d45a8ece75948bbc6f0e016a624f3000b12148fe
SHA256bbcfacae3d17e8bc208d5c7bed61c00ef8591ee27bee2ceaa94a2c1231a512fc
SHA51250192524d5e4e830e1d9f62f31ec5983bde14c09cbeab9ef75bc84617cb0ed16d51b49b7e141c87f265d3315c32cd9ea96d8dd46c640a0b7af1f1cb4ffaf5da2
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\Tw1fgF7OZes8kyt.exeFilesize
770KB
MD5a82d1b7ae1c33f81f672f8854ffccd3f
SHA1d45a8ece75948bbc6f0e016a624f3000b12148fe
SHA256bbcfacae3d17e8bc208d5c7bed61c00ef8591ee27bee2ceaa94a2c1231a512fc
SHA51250192524d5e4e830e1d9f62f31ec5983bde14c09cbeab9ef75bc84617cb0ed16d51b49b7e141c87f265d3315c32cd9ea96d8dd46c640a0b7af1f1cb4ffaf5da2
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\fjmhhkhebjokmaacjcgbhbnjfagcckkl\background.htmlFilesize
146B
MD5f511cccbcccbf06c5ffbf77397e410a1
SHA168718be01f718b7ceb8cbbc11d56df78db14a26e
SHA256fef399d48cab2d60b3cbe9b9c72d78b2d673bee866425f2d5e5b6afa4699a2aa
SHA512cc25faae2dc6a2a3671a4f251a88c5e1300efcb03e4af5fe01b4cffc6f53647a3bdeb0613cfba7d4b412caf91e8f2c7fc125ece6c3d63fbe2838f936ed3ce45f
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\fjmhhkhebjokmaacjcgbhbnjfagcckkl\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\fjmhhkhebjokmaacjcgbhbnjfagcckkl\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\fjmhhkhebjokmaacjcgbhbnjfagcckkl\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSACA6.tmp\fjmhhkhebjokmaacjcgbhbnjfagcckkl\yY8jPx6IH.jsFilesize
5KB
MD5a655c848255f1953e5884d78845e5f5e
SHA174c1da3e3480e3c99019d722816b477f4227872b
SHA2568536a6206614caa9955961786c8c50b00db60213f9d8f419e45f716cb5eef59e
SHA5125f7ec5240591daa53703e8d8d7e4806b24d1524234b4c58311608bdcc22b915e643e00bd9264787394b042f7b7077d7105bd0a01d680bf2dffa28b3fd8ca409c
-
memory/1088-132-0x0000000000000000-mapping.dmp
-
memory/4824-149-0x0000000000000000-mapping.dmp