a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc

Analysis

max time kernel
169s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe
Size

931KB
MD5

6e6717c664e3f98bee42c4e03188d83d
SHA1

b83be1abdd9ddd1ae7358ddb791f88f936d8904f
SHA256

a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc
SHA512

2e34281094e2ac536d515a9d2800aa0303d398e33f2174bc4594f9f6d80fe2d71bd0d26dc6cdf2f6d8e7347bbeaced01f9af37282a26c650435f6c773aa69e6a
SSDEEP

24576:h1OYdaOeCZ/iWCvu/2sWsJA/jlt+DHhsX:h1OsQCpYO/dJJDHhsX

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ef2J1pE6bYQvtoW.exe

pid process

2132 ef2J1pE6bYQvtoW.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

ef2J1pE6bYQvtoW.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdohgdifkcngnjmaooakbaifoijmcoo\2.0\manifest.json	ef2J1pE6bYQvtoW.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdohgdifkcngnjmaooakbaifoijmcoo\2.0\manifest.json	ef2J1pE6bYQvtoW.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdohgdifkcngnjmaooakbaifoijmcoo\2.0\manifest.json	ef2J1pE6bYQvtoW.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdohgdifkcngnjmaooakbaifoijmcoo\2.0\manifest.json	ef2J1pE6bYQvtoW.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdohgdifkcngnjmaooakbaifoijmcoo\2.0\manifest.json	ef2J1pE6bYQvtoW.exe

Drops file in System32 directory 4 IoCs

Processes:

ef2J1pE6bYQvtoW.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	ef2J1pE6bYQvtoW.exe
File opened for modification	C:\Windows\System32\GroupPolicy	ef2J1pE6bYQvtoW.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	ef2J1pE6bYQvtoW.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	ef2J1pE6bYQvtoW.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ef2J1pE6bYQvtoW.exe

pid	process
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe
2132	ef2J1pE6bYQvtoW.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ef2J1pE6bYQvtoW.exe

description	pid	process
Token: SeDebugPrivilege	2132	ef2J1pE6bYQvtoW.exe
Token: SeDebugPrivilege	2132	ef2J1pE6bYQvtoW.exe
Token: SeDebugPrivilege	2132	ef2J1pE6bYQvtoW.exe
Token: SeDebugPrivilege	2132	ef2J1pE6bYQvtoW.exe
Token: SeDebugPrivilege	2132	ef2J1pE6bYQvtoW.exe
Token: SeDebugPrivilege	2132	ef2J1pE6bYQvtoW.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe

description	pid	process	target process
PID 4996 wrote to memory of 2132	4996	a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe	ef2J1pE6bYQvtoW.exe
PID 4996 wrote to memory of 2132	4996	a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe	ef2J1pE6bYQvtoW.exe
PID 4996 wrote to memory of 2132	4996	a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe	ef2J1pE6bYQvtoW.exe

C:\Users\Admin\AppData\Local\Temp\a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe
"C:\Users\Admin\AppData\Local\Temp\a4e040804d17566ff7b1b41b51d15e6207e866ca1c586007237d42045217b3dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996

C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\ef2J1pE6bYQvtoW.exe
.\ef2J1pE6bYQvtoW.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
77b07fc624a9dd7a58a0f6391634a700

SHA1
32c2113b9074cd4a6a0f5fd7cf8baec7ed5c06de

SHA256
167c718a8a30a63815dd576dca22fcf69b710735226ddc53df8963de29c46a7f

SHA512
2255edc0128c16fc24fed0a8883ce61b8cf59bb243986c6d7232bee7803db5c2393a91a063437adce9ef167feff5703b158afe70f6512c2fb46a457f03b9a9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
5f4abb97056dbfad708433dfc368ceba

SHA1
04bfa77bd18f0bbf6c86ac7c836e89871762d196

SHA256
13b9dbf13ac882bc5e255e1700a4e2dc88b5b9d9ad1d0ae68868b33ed4804eb1

SHA512
f0de9dacd27a02b688ccb69e65a84bdc0fc770078f7aabdc082b2f036572c216f5e3d2126bd14561797803722c2e7f68f9df95b8cf66e65fed9b23bc069260c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\[email protected]\install.rdf

Filesize
595B

MD5
89268b3294d6780338f5443a3da174bc

SHA1
5e0409b221ec60c705e1a6be4527ad2256222702

SHA256
1b1e1f46dc8a66af1f0e0bf0f164d329c6b44650c5ec8242c31f08685df6d53b

SHA512
06f3396ead64fe3b506c6d4ca092d811f943505b8c4ba187b927dfaa103e79df61034d58cbf8e3de0d961ec7419f30024b86b86a3b68b2571dc772660c67c99e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\ef2J1pE6bYQvtoW.dat

Filesize
1KB

MD5
10699386426bb1b74d2b45edd7b5a8a4

SHA1
6afaf14e698482ca9328edd704f40c477a6b8292

SHA256
5762c3cca189e729e07b4a761c446c84f9b5ae8c01cf4842904e1b87365d711e

SHA512
f4b5a60d4e6877e435b41d26b6d31191994d06c19729c86ede3a1e241784100eec0d4de42937d26e8b1dbb3bbef5601dc41b85e18cf139a2001e071b741384f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\ef2J1pE6bYQvtoW.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\ef2J1pE6bYQvtoW.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\nmdohgdifkcngnjmaooakbaifoijmcoo\EyCzSLN.js

Filesize
6KB

MD5
d9cee761d17ff4cc02dbf685c3025202

SHA1
6a6fa1b497ceccb7ecc3815ab63d682de0e99f0a

SHA256
5cbacd6b38cb3d237cf2167cb963cb944d1668762a27ced04253266d322acb36

SHA512
a339d36c4091d3e658d3650a2c93b3fa3dd1182502cf838475155d0111e25dfeaa929abbb052cc12da0275d0847fea3f82b3bbdea927272acd376d1da5a43b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\nmdohgdifkcngnjmaooakbaifoijmcoo\background.html

Filesize
144B

MD5
e1d00047d094bf4b1d4ee67d8a13d530

SHA1
0a2a32b14fdc54929013b6f64a867ef875fe51b7

SHA256
47c84c62431b09b0fc7d781eefabaffa9939bea61acf674764930f2016f92c99

SHA512
25aa81ef6d09e7d5d90e322e2face7bf086a1702b737c1a9005c0ff8db2397e139d409470b981dc50f31aa9569c3abef6b0bb93c17ca228c97dc91ce674c8fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\nmdohgdifkcngnjmaooakbaifoijmcoo\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\nmdohgdifkcngnjmaooakbaifoijmcoo\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDC2C.tmp\nmdohgdifkcngnjmaooakbaifoijmcoo\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/2132-132-0x0000000000000000-mapping.dmp

Download