a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4

Analysis

max time kernel
151s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe
Size

931KB
MD5

2205a967b726403b032785fce4ad5de4
SHA1

8c92832dd2ea31480f827e92f9188558430ec60c
SHA256

a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4
SHA512

a0de36c98702be63dc23cee37a96663df377c6991adf9cca6223e19f8adbf38959d2b7176938829ea0547eec43a6831e895af026a3e7e9c4f2d3fb2f9225e4a0
SSDEEP

24576:h1OYdaOwCZ/iWCvu/2sWsJA/jlt+DHhs/:h1OsmCpYO/dJJDHhs/

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ztMkDhj7moorCXA.exe

pid process

60 ztMkDhj7moorCXA.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ztMkDhj7moorCXA.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdlmdamidkigibknefaladmifmgmmpli\2.0\manifest.json	ztMkDhj7moorCXA.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdlmdamidkigibknefaladmifmgmmpli\2.0\manifest.json	ztMkDhj7moorCXA.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdlmdamidkigibknefaladmifmgmmpli\2.0\manifest.json	ztMkDhj7moorCXA.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdlmdamidkigibknefaladmifmgmmpli\2.0\manifest.json	ztMkDhj7moorCXA.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdlmdamidkigibknefaladmifmgmmpli\2.0\manifest.json	ztMkDhj7moorCXA.exe

Drops file in System32 directory 4 IoCs

Processes:

ztMkDhj7moorCXA.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ztMkDhj7moorCXA.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ztMkDhj7moorCXA.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ztMkDhj7moorCXA.exe
File opened for modification	C:\Windows\System32\GroupPolicy	ztMkDhj7moorCXA.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ztMkDhj7moorCXA.exe

pid	process
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe
60	ztMkDhj7moorCXA.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ztMkDhj7moorCXA.exe

description	pid	process
Token: SeDebugPrivilege	60	ztMkDhj7moorCXA.exe
Token: SeDebugPrivilege	60	ztMkDhj7moorCXA.exe
Token: SeDebugPrivilege	60	ztMkDhj7moorCXA.exe
Token: SeDebugPrivilege	60	ztMkDhj7moorCXA.exe
Token: SeDebugPrivilege	60	ztMkDhj7moorCXA.exe
Token: SeDebugPrivilege	60	ztMkDhj7moorCXA.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe

description	pid	process	target process
PID 524 wrote to memory of 60	524	a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe	ztMkDhj7moorCXA.exe
PID 524 wrote to memory of 60	524	a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe	ztMkDhj7moorCXA.exe
PID 524 wrote to memory of 60	524	a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe	ztMkDhj7moorCXA.exe

C:\Users\Admin\AppData\Local\Temp\a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe
"C:\Users\Admin\AppData\Local\Temp\a49c1c9266c5d0d6cb9b8937fc74d5aede85cee44f977ad2bbaf7a7d4839c7d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\ztMkDhj7moorCXA.exe
.\ztMkDhj7moorCXA.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\bdlmdamidkigibknefaladmifmgmmpli\DJ.js
Filesize
6KB

MD5
35cd6d658429279ac52e59789a137769

SHA1
6d82539c96a3fe5ca6393ee199fbf8a4823b32c0

SHA256
2f35e5a1b33f9d3c629ac2c78dead70354285e3f036e3106c7b8822008fb5b6a

SHA512
00a0ec218a4ddb9a28a1048175b7df243105e702007329506af70b20b5a7897c4f4806169c4ec429866fe3645e0a390827984d1af68c95d6b21c8ed5da4f18b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\bdlmdamidkigibknefaladmifmgmmpli\background.html
Filesize
139B

MD5
63be85e9cb30fdc373c083f8a36d7c71

SHA1
4d763431b759d98ebd6f33a5fad8af9d62e4fcb4

SHA256
17ca7182377f66ea5459f38b8cf73122190d957fa55dc7f20d81dc8774944177

SHA512
69d0387c8ec8d5444bb77fde7b26d0e797563dd32d1d998aaeac344db39f8309bb0ec90d49a566b3139b9cdd2998a672e4abac63d432fdb4e88524f243f66dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\bdlmdamidkigibknefaladmifmgmmpli\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\bdlmdamidkigibknefaladmifmgmmpli\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\bdlmdamidkigibknefaladmifmgmmpli\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
fbbcb44185a6551bb28d23ba7af9eb0e

SHA1
b1a131287b685d0ecd18ba2cb581ffebb25140fc

SHA256
7ff7f1bec38f5af4e9647ab220ff8017c6fab4ef4b3cfecc1f216ef122e95a87

SHA512
e7b24fd44e882f5aeb41ec0aa5643f1d28d867369121d47dc90270fd995b542fdac82fbd352039fd47d16a15c2a5768d27b10e158d44eb5d4e3df17ff9d90f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
c8d0ebdcd53608893a3525f1e64f29c2

SHA1
bb57e458d1ef98d23689c320d64724fc783164c4

SHA256
d7c15bd57f30c512ac6ae6f70ef64a102756a4aa8b1dc7345b2a57f7c199c067

SHA512
15030b055f671d9b84527e66cd53c3485810ded6061133fa84eecb33392ec32b23ce22b558016c15e9356f31649b473ab32459cc37439317a98203487bfc8efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\[email protected]\install.rdf
Filesize
593B

MD5
20e218be95bf0f116a986ef6249aa073

SHA1
cb29802c08c3571ba714dae8de975148636f5c49

SHA256
8200888714122b8de66644f0096307dc158545802c5bf0ed2bde51aecd8060bc

SHA512
349ce260604183baa78f456e43ba3942082b93b52b739995d29053f115015c611135ddaa67968d7ed2c2ffde01377892847f84fe4f3a8132d416d0ce49e589d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\ztMkDhj7moorCXA.dat
Filesize
1KB

MD5
39f34bf2d38091d9b777ca2c180081f4

SHA1
5cb1d9d33faf47c2dca0d08a631346f49c1b2100

SHA256
05cfca4272b4c824890ef55b3f2b734295b506366fc7da60733a2d23c896ce05

SHA512
d5b3df98328e62325f902ce29a0f23dd9b0073ea17dd0547f80fdd6fa2e98afef1321bde01ba104d2aae9a9c3aa7241b11aa3106d4d012ae4055dc92753ff4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\ztMkDhj7moorCXA.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB5A.tmp\ztMkDhj7moorCXA.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/60-132-0x0000000000000000-mapping.dmp

Download