Analysis
-
max time kernel
170s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:14
Static task
static1
Behavioral task
behavioral1
Sample
a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe
Resource
win7-20221111-en
General
-
Target
a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe
-
Size
920KB
-
MD5
aca6d174332f9f514a90737c8a76666f
-
SHA1
bfbf3fcef661b38cc4a1966dddc7567b5b8324f8
-
SHA256
a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff
-
SHA512
97753fb509326ca90181a29232ed3785dcdb2a5f87d355e253eea0d6530270bd0b1e7d16b186f839275438fd377d64394808e6b5bdd11fec048e4811c11bfa48
-
SSDEEP
24576:h1OYdaOyMtdHAqcdDVhYwiei7+EpFAh/kKF:h1OsbPHVmVhYwiLtKkKF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
r7fOOhtixo3KMMD.exepid process 1684 r7fOOhtixo3KMMD.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
r7fOOhtixo3KMMD.exedescription ioc process File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmmdoddgffkphogjbbdokjkoankojfjj\2.0\manifest.json r7fOOhtixo3KMMD.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmmdoddgffkphogjbbdokjkoankojfjj\2.0\manifest.json r7fOOhtixo3KMMD.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmmdoddgffkphogjbbdokjkoankojfjj\2.0\manifest.json r7fOOhtixo3KMMD.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmmdoddgffkphogjbbdokjkoankojfjj\2.0\manifest.json r7fOOhtixo3KMMD.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmmdoddgffkphogjbbdokjkoankojfjj\2.0\manifest.json r7fOOhtixo3KMMD.exe -
Drops file in System32 directory 4 IoCs
Processes:
r7fOOhtixo3KMMD.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol r7fOOhtixo3KMMD.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI r7fOOhtixo3KMMD.exe File opened for modification C:\Windows\System32\GroupPolicy r7fOOhtixo3KMMD.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini r7fOOhtixo3KMMD.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
r7fOOhtixo3KMMD.exepid process 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe 1684 r7fOOhtixo3KMMD.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
r7fOOhtixo3KMMD.exedescription pid process Token: SeDebugPrivilege 1684 r7fOOhtixo3KMMD.exe Token: SeDebugPrivilege 1684 r7fOOhtixo3KMMD.exe Token: SeDebugPrivilege 1684 r7fOOhtixo3KMMD.exe Token: SeDebugPrivilege 1684 r7fOOhtixo3KMMD.exe Token: SeDebugPrivilege 1684 r7fOOhtixo3KMMD.exe Token: SeDebugPrivilege 1684 r7fOOhtixo3KMMD.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exedescription pid process target process PID 2112 wrote to memory of 1684 2112 a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe r7fOOhtixo3KMMD.exe PID 2112 wrote to memory of 1684 2112 a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe r7fOOhtixo3KMMD.exe PID 2112 wrote to memory of 1684 2112 a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe r7fOOhtixo3KMMD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe"C:\Users\Admin\AppData\Local\Temp\a594de96e8a1cdcc0111d7a0d44ba4189bab9452d2c71a7678dac8712a1ba4ff.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\r7fOOhtixo3KMMD.exe.\r7fOOhtixo3KMMD.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\cmmdoddgffkphogjbbdokjkoankojfjj\O.jsFilesize
6KB
MD5ae9143defc83d65cbf4d644a89728bb0
SHA1b7bc8795a3226628792f94756aba91368bf53416
SHA256ce68d3c9987fcae796abbb7d90f72d69752e1a340fd368928af2d32e2d0e951b
SHA512003cf12d50cf5b49d23594623ec01b771b7dd48497b4c43a569eec5670d848cf94302bcb9f888e4dab3cafeabebbba01abc920ed844fa1c9d8ae9ef0d0d4bdb3
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\cmmdoddgffkphogjbbdokjkoankojfjj\background.htmlFilesize
138B
MD5431e9f60fcbaa4666cec92a75daa0e52
SHA10adfce166a566c89de7362a774fba64b90fea747
SHA256c68836141f9a464ae5d1aad344d7c16b0af1a47ef179ae2b50e30de2fddb2fcf
SHA51246c8ad2c9af194010250f98f27704fb1a9d2aca4964f70585593c46310d2f178105e70962e3cfa3a1811e427109766ccd5fca72259171aa567e9f57ab5e6babf
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\cmmdoddgffkphogjbbdokjkoankojfjj\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\cmmdoddgffkphogjbbdokjkoankojfjj\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\cmmdoddgffkphogjbbdokjkoankojfjj\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\r7fOOhtixo3KMMD.datFilesize
1KB
MD53a70f88baf650b1d89c8bae0d985772b
SHA156f66dc0f732ea4b0ee43f188607c79e8c287c6d
SHA256500d53d32be4052713531b161e8dd7a1adadce425bd697a2abad0b7ee75a152f
SHA512e53f1c4e59af0d8d6c08653d54df25b8a45fb047d608b524c00f1e1d239a1c772d9557e72dd706a632caa43ebf65ed47e48441789237fc41f682a4500ff1c3a2
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\r7fOOhtixo3KMMD.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\r7fOOhtixo3KMMD.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\[email protected]\chrome.manifestFilesize
35B
MD5e03aa4c03150fc4be22dbd4736953579
SHA14d390b8a4d54d443927cde84fc5375827bca45b6
SHA256ce85e7ffe3398e4f13bdd62dfbe46b3d1cad3d5fcf2bccd211e97782b1d4b6be
SHA512eb509727188e0254da705d8aca8cd44eae0e95ac0a146012a3b1bca2132f51e703dca9f86acbbf30afe8ba56312a98bd64834d5f1b60e60d010fd8394ab05245
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5bac5a7a2ebeea8e92feaddc350f758f8
SHA14b152092351a99a4ff990d0ddc1c5e1f7bd7c749
SHA2569f00cd4fb8db736fdb1b82f936de0cbaa3fbe412fd01038ede461283007be6bb
SHA512b47d0ddb9620e4e453edde6054daa695046bf7faf8b32b38de0c3c7e7b226efe2cd76563122d76ad1e2e72f49de8bc74e9156332f44dd1bc3170a4ba3dce7168
-
C:\Users\Admin\AppData\Local\Temp\7zS3C4D.tmp\[email protected]\install.rdfFilesize
593B
MD5e94afb55bb8be1cc5191be5bfca3fd48
SHA14f07adb64901874d8a95b9ee1012e7361c70c2b6
SHA2566c26948add0c11746d6a4e832d6b8d227184c6e3f8a78709124ca85deb24ebc9
SHA512e1cebae02dedb8ab4247d7d23176b9326509a7daa666f82900b15b8d11f16707a538084356c3ba0de947a93ae68c9c98d46924f7a46cef104bfd0b85faef5094
-
memory/1684-132-0x0000000000000000-mapping.dmp