Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 21:16

General

  • Target

    a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe

  • Size

    931KB

  • MD5

    8d873c95b3eb950312bd229a219a251e

  • SHA1

    00a7cc4ec56683e0f81f4307ed6c20224470aa0d

  • SHA256

    a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555

  • SHA512

    1cc65832206118d86122e9164e54d7c60d82de8b9197b9b8476d2b11772965740ec0e5d9f5eb6451bbb95f6464237bc7d10c77db4d2ebab04fc3962bcf17003f

  • SSDEEP

    24576:h1OYdaOACZ/iWCvu/2sWsJA/jlt+DHhsj:h1OsuCpYO/dJJDHhsj

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe
    "C:\Users\Admin\AppData\Local\Temp\a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\3pLl4FkXLtWmoMb.exe
      .\3pLl4FkXLtWmoMb.exe
      2⤵
      • Executes dropped EXE
      • Drops Chrome extension
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    52fcb21b81f7c789e4cd351a0f0ae3ec

    SHA1

    74e3c8771841d1776eaf06061ba100c4405453e6

    SHA256

    beb10db0083627086c4ec8c6705acc9692aa2f5c221294ba7cc8e64a4e6fb56f

    SHA512

    c3a82803f0f65197447ac157c30d3328f170246f9a71b19c929e6d86e2d1ffdd632452526fe9cce53791fe65aafde9aa2e5e97d5e431bbaaba4ce228a6dc9ccf

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\[email protected]\content\bg.js

    Filesize

    8KB

    MD5

    512d65198d1ed379a6a5a030a60ac89b

    SHA1

    7d492280119915da2468cb33e8122dd35bde94b5

    SHA256

    42d2921cb2c82bd85e91a1567ad2c17f8a6fa0233065768a5d8c193314b89f58

    SHA512

    36b6912dd9b1714b8629648154a13e7a389a85525a932eea8ac0b3f4ed7e99c36a0cbf6da0d961c56dfba78fc90dc9c41a1edc17e571027d486f63571fb9ae4d

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\[email protected]\install.rdf

    Filesize

    592B

    MD5

    323f229d348ed375b512288ed13da520

    SHA1

    3e1e3d4c6c98755decbef999672b03e66ce2ac33

    SHA256

    ca0a4700ae22573627e43a6a41eacc10584f3399142d295f1820bcde7542cc0f

    SHA512

    f13c43d9c506d5ce60bea194d9d69208a3ad5ba4742cc4502761ac25dce79a68e310e0b5695fc584248d6d859a47cdd2009b1c5b90b29390f0376987c51d5fb0

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\3pLl4FkXLtWmoMb.dat

    Filesize

    1KB

    MD5

    bbfea0a005b74d90d7c60ae62299b741

    SHA1

    f20a17fc29f19414ad47d647a38cb70c43590c62

    SHA256

    3ee7ed459552e99b0d734654a522a0b23f0c736996645476c409e6fccdb96baf

    SHA512

    2aaadaa0356b7dcab9edd881fd764ea3bc5651196e303943ce7c693944fcf4bebf00bbfc03af12aa2c76a7b021cf2547ea661a07b3d4957b51498b057ff82aec

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\3pLl4FkXLtWmoMb.exe

    Filesize

    772KB

    MD5

    5ed7019dcd0008dbcd8e54017b8c7dd9

    SHA1

    7e4457da2ff06c2170bad636c9eb7c1bb436fd06

    SHA256

    7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

    SHA512

    10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\midjmidmiookpkbkbapcgiggdelomgfm\background.html

    Filesize

    140B

    MD5

    76abfd8b9aaba7ebafb6428fc507591a

    SHA1

    e6ea675077dd2a2286ad66f7fa0998655ae7b4e9

    SHA256

    fa2a82b29522c6098b30eed41ad461ed1ee1baa1f3c62b262debaef2a96a0a62

    SHA512

    cc3a55a8bf7eea0b07959e7f82d6c008fbae5e879ac0dc88e08771a57fd0fc887bffbcadbebfb276019ac44b87ee535850b68353439386bf408630ecbc995e0c

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\midjmidmiookpkbkbapcgiggdelomgfm\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\midjmidmiookpkbkbapcgiggdelomgfm\kIl.js

    Filesize

    6KB

    MD5

    ce5b6a1f9e8c844cc2c768e14fab8a7a

    SHA1

    ef3909425eb2db4359789ff450c763e583e48fc5

    SHA256

    96992258f6a1f15dca7478b8deae7422cd3bd04d2e7d7b74737888d79fee9b1c

    SHA512

    35169709f109b098cf0b25eae92b32b11c42ff3dfd3869cf87b209035b1820e08c8f1e70f24512fb13ea1732ac820ff4546578c3977f90b97724385ab5f0dd51

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\midjmidmiookpkbkbapcgiggdelomgfm\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSA8C.tmp\midjmidmiookpkbkbapcgiggdelomgfm\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • \Users\Admin\AppData\Local\Temp\7zSA8C.tmp\3pLl4FkXLtWmoMb.exe

    Filesize

    772KB

    MD5

    5ed7019dcd0008dbcd8e54017b8c7dd9

    SHA1

    7e4457da2ff06c2170bad636c9eb7c1bb436fd06

    SHA256

    7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

    SHA512

    10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

  • memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

    Filesize

    8KB