Analysis
-
max time kernel
155s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:16
Static task
static1
Behavioral task
behavioral1
Sample
a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe
Resource
win7-20220901-en
General
-
Target
a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe
-
Size
931KB
-
MD5
8d873c95b3eb950312bd229a219a251e
-
SHA1
00a7cc4ec56683e0f81f4307ed6c20224470aa0d
-
SHA256
a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555
-
SHA512
1cc65832206118d86122e9164e54d7c60d82de8b9197b9b8476d2b11772965740ec0e5d9f5eb6451bbb95f6464237bc7d10c77db4d2ebab04fc3962bcf17003f
-
SSDEEP
24576:h1OYdaOACZ/iWCvu/2sWsJA/jlt+DHhsj:h1OsuCpYO/dJJDHhsj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 420 3pLl4FkXLtWmoMb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\midjmidmiookpkbkbapcgiggdelomgfm\2.0\manifest.json 3pLl4FkXLtWmoMb.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\midjmidmiookpkbkbapcgiggdelomgfm\2.0\manifest.json 3pLl4FkXLtWmoMb.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\midjmidmiookpkbkbapcgiggdelomgfm\2.0\manifest.json 3pLl4FkXLtWmoMb.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\midjmidmiookpkbkbapcgiggdelomgfm\2.0\manifest.json 3pLl4FkXLtWmoMb.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\midjmidmiookpkbkbapcgiggdelomgfm\2.0\manifest.json 3pLl4FkXLtWmoMb.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy 3pLl4FkXLtWmoMb.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 3pLl4FkXLtWmoMb.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 3pLl4FkXLtWmoMb.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 3pLl4FkXLtWmoMb.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe 420 3pLl4FkXLtWmoMb.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 420 3pLl4FkXLtWmoMb.exe Token: SeDebugPrivilege 420 3pLl4FkXLtWmoMb.exe Token: SeDebugPrivilege 420 3pLl4FkXLtWmoMb.exe Token: SeDebugPrivilege 420 3pLl4FkXLtWmoMb.exe Token: SeDebugPrivilege 420 3pLl4FkXLtWmoMb.exe Token: SeDebugPrivilege 420 3pLl4FkXLtWmoMb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1664 wrote to memory of 420 1664 a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe 80 PID 1664 wrote to memory of 420 1664 a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe 80 PID 1664 wrote to memory of 420 1664 a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe"C:\Users\Admin\AppData\Local\Temp\a505e6cb8469a79b13f574278be80b8701d6750b1f7de20f39080782a9f0f555.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\7zS9C93.tmp\3pLl4FkXLtWmoMb.exe.\3pLl4FkXLtWmoMb.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4744
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS9C93.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9C93.tmp\[email protected]\chrome.manifest
Filesize35B
MD552fcb21b81f7c789e4cd351a0f0ae3ec
SHA174e3c8771841d1776eaf06061ba100c4405453e6
SHA256beb10db0083627086c4ec8c6705acc9692aa2f5c221294ba7cc8e64a4e6fb56f
SHA512c3a82803f0f65197447ac157c30d3328f170246f9a71b19c929e6d86e2d1ffdd632452526fe9cce53791fe65aafde9aa2e5e97d5e431bbaaba4ce228a6dc9ccf
-
C:\Users\Admin\AppData\Local\Temp\7zS9C93.tmp\[email protected]\content\bg.js
Filesize8KB
MD5512d65198d1ed379a6a5a030a60ac89b
SHA17d492280119915da2468cb33e8122dd35bde94b5
SHA25642d2921cb2c82bd85e91a1567ad2c17f8a6fa0233065768a5d8c193314b89f58
SHA51236b6912dd9b1714b8629648154a13e7a389a85525a932eea8ac0b3f4ed7e99c36a0cbf6da0d961c56dfba78fc90dc9c41a1edc17e571027d486f63571fb9ae4d
-
C:\Users\Admin\AppData\Local\Temp\7zS9C93.tmp\[email protected]\install.rdf
Filesize592B
MD5323f229d348ed375b512288ed13da520
SHA13e1e3d4c6c98755decbef999672b03e66ce2ac33
SHA256ca0a4700ae22573627e43a6a41eacc10584f3399142d295f1820bcde7542cc0f
SHA512f13c43d9c506d5ce60bea194d9d69208a3ad5ba4742cc4502761ac25dce79a68e310e0b5695fc584248d6d859a47cdd2009b1c5b90b29390f0376987c51d5fb0
-
Filesize
1KB
MD5bbfea0a005b74d90d7c60ae62299b741
SHA1f20a17fc29f19414ad47d647a38cb70c43590c62
SHA2563ee7ed459552e99b0d734654a522a0b23f0c736996645476c409e6fccdb96baf
SHA5122aaadaa0356b7dcab9edd881fd764ea3bc5651196e303943ce7c693944fcf4bebf00bbfc03af12aa2c76a7b021cf2547ea661a07b3d4957b51498b057ff82aec
-
Filesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
Filesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
Filesize
140B
MD576abfd8b9aaba7ebafb6428fc507591a
SHA1e6ea675077dd2a2286ad66f7fa0998655ae7b4e9
SHA256fa2a82b29522c6098b30eed41ad461ed1ee1baa1f3c62b262debaef2a96a0a62
SHA512cc3a55a8bf7eea0b07959e7f82d6c008fbae5e879ac0dc88e08771a57fd0fc887bffbcadbebfb276019ac44b87ee535850b68353439386bf408630ecbc995e0c
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
6KB
MD5ce5b6a1f9e8c844cc2c768e14fab8a7a
SHA1ef3909425eb2db4359789ff450c763e583e48fc5
SHA25696992258f6a1f15dca7478b8deae7422cd3bd04d2e7d7b74737888d79fee9b1c
SHA51235169709f109b098cf0b25eae92b32b11c42ff3dfd3869cf87b209035b1820e08c8f1e70f24512fb13ea1732ac820ff4546578c3977f90b97724385ab5f0dd51
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a