a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523

Analysis

max time kernel
159s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe
Size

931KB
MD5

3beefa0afe9e3a1a4b9b375d7cac2fff
SHA1

a771ecf93004eddb1d0d7bede53884dd190ac823
SHA256

a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523
SHA512

b5dec05794f11411ab957ac504d2abcd3816e3398355f7e1a5a4c663a91ef970922540c1fbd605658c8cbdc6d169d3f729e3d15b4376408c8c7cbdfe07b318ea
SSDEEP

24576:h1OYdaOACZ/iWCvu/2sWsJA/jlt+DHhsd:h1OsiCpYO/dJJDHhsd

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

HZ0WXi7texsaYCU.exe

pid process

1520 HZ0WXi7texsaYCU.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

HZ0WXi7texsaYCU.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnagdocnnmggamobaodbdmfgmdoookbl\2.0\manifest.json	HZ0WXi7texsaYCU.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnagdocnnmggamobaodbdmfgmdoookbl\2.0\manifest.json	HZ0WXi7texsaYCU.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnagdocnnmggamobaodbdmfgmdoookbl\2.0\manifest.json	HZ0WXi7texsaYCU.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnagdocnnmggamobaodbdmfgmdoookbl\2.0\manifest.json	HZ0WXi7texsaYCU.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnagdocnnmggamobaodbdmfgmdoookbl\2.0\manifest.json	HZ0WXi7texsaYCU.exe

Drops file in System32 directory 4 IoCs

Processes:

HZ0WXi7texsaYCU.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	HZ0WXi7texsaYCU.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	HZ0WXi7texsaYCU.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	HZ0WXi7texsaYCU.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	HZ0WXi7texsaYCU.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

HZ0WXi7texsaYCU.exe

pid	process
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe
1520	HZ0WXi7texsaYCU.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

HZ0WXi7texsaYCU.exe

description	pid	process
Token: SeDebugPrivilege	1520	HZ0WXi7texsaYCU.exe
Token: SeDebugPrivilege	1520	HZ0WXi7texsaYCU.exe
Token: SeDebugPrivilege	1520	HZ0WXi7texsaYCU.exe
Token: SeDebugPrivilege	1520	HZ0WXi7texsaYCU.exe
Token: SeDebugPrivilege	1520	HZ0WXi7texsaYCU.exe
Token: SeDebugPrivilege	1520	HZ0WXi7texsaYCU.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe

description	pid	process	target process
PID 3948 wrote to memory of 1520	3948	a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe	HZ0WXi7texsaYCU.exe
PID 3948 wrote to memory of 1520	3948	a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe	HZ0WXi7texsaYCU.exe
PID 3948 wrote to memory of 1520	3948	a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe	HZ0WXi7texsaYCU.exe

C:\Users\Admin\AppData\Local\Temp\a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe
"C:\Users\Admin\AppData\Local\Temp\a49143fd3dcd4524c41d0c2186a863879d83e3e27bdffa5ea43c157076e1c523.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3948

C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\HZ0WXi7texsaYCU.exe
.\HZ0WXi7texsaYCU.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
0e28406987044bab6a454eda0895cade

SHA1
184b625adf7e79616b51e73a715302e1e63bfbb7

SHA256
74a7224910566be122fd22e26ea509042f6b29007dc1e7d08f3c5727905c98c7

SHA512
d2cd6d1a7bb051bf86e1ad56ec0e532883d5d56e860f8814e2bc085b95d89719848040e31c4e379a038f91cd79b31ec40e7adfc6ac47f7b6c5d91355d8e246c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
ce957174434aa04ec8db90940b106bf9

SHA1
51c58553806d960e33ac883250f6f3e8155be5bb

SHA256
6a908f188cb5deaeab6e5739d9c24376d57fc3c1a632b8c783458f1f34dcf91f

SHA512
654be7a95f2e4520a8cd139ec319e5fd1c1b1b99177e805d9a2568f6e87e96a686a3b1451b93b3f9e8861fef44f8559516eb9b31ff4050e8fcb31a5d4dab08e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\[email protected]\install.rdf
Filesize
598B

MD5
ba0e0903a2aad8e6ce5339790142ee33

SHA1
f95d31d58f67586eecc9e261f16a23978685baf2

SHA256
886c39e61974235485247ff44bd4bea9a205e026bd9e186db2e2435d6995ce28

SHA512
4fe445d7e5a1c0ab7d51fd417b5cc3fc12faf3b5c1df9d4f62172fb234612edfaf10b2542e5847e8d3a8a6bb48f598c2c8b842a70c7306e8ba935193b55d4f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\HZ0WXi7texsaYCU.dat
Filesize
1KB

MD5
6eb7ad5b370e448446dca097a4dacece

SHA1
64aa3c65daf8742fb2aaae2c8542c41bb57266dc

SHA256
d42c849d36323015409df8c4d712794d8d9d2fa8cb72e645368ae92855124ea6

SHA512
297bb46e3aaf37925df725ed14167edf098bd1b8c4d4b6f81067e2814a049eb066a861f3cb78a4a40bf7f662446d1888ddb17e3345393841676ddbd2599f8ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\HZ0WXi7texsaYCU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\HZ0WXi7texsaYCU.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\dnagdocnnmggamobaodbdmfgmdoookbl\background.html
Filesize
144B

MD5
61c250ef0456c9ed53d2b1dc7d2becd3

SHA1
58a1a2393e73c578ec24ab1f8bfe0d579f3755d2

SHA256
418c62bd323f711d7ae34a0baef2a63c4fc4e931e7211907a322b00810e9e583

SHA512
a118674935a5e2e83c91acc88b7b90c0f45f57f269117b7ad59243042c813f2d46afb91070446a0f309e02a664e0e7d1f6583985ec579f292e31a35d185ee1e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\dnagdocnnmggamobaodbdmfgmdoookbl\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\dnagdocnnmggamobaodbdmfgmdoookbl\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\dnagdocnnmggamobaodbdmfgmdoookbl\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF9F5.tmp\dnagdocnnmggamobaodbdmfgmdoookbl\scOa3NB.js
Filesize
6KB

MD5
d65f43917bf6767f3ddc12f5b8b22da2

SHA1
648940739da7ff8a9d57968d528611c4d1350705

SHA256
fd9b2e1fbb47ce4663b026bacf48c37594542b11528f8796eaad3c378404980f

SHA512
5cd15ad6c8d01020028be355c2689facb458538c904b078e985e8ae6e86a26104766f25025da0abde0998dd0664203ee78d5f6373162cab3fbb479d4f5e200ca

Download Submit
memory/1520-132-0x0000000000000000-mapping.dmp

Download