Analysis
-
max time kernel
31s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe
Resource
win7-20220812-en
General
-
Target
a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe
-
Size
932KB
-
MD5
6fa9ec0cdddbc08a5b1cdc5e5b7d62b2
-
SHA1
9b9567542ccad714bebd016bd191cde34d978dcc
-
SHA256
a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a
-
SHA512
2b87403d1b8cded0c8d7d204b76a245a8bd8e3ddd2c6960e43f4a41ebcdea924b4881c477ff328d79025d1ddbb281f66494da92dbc8db7f5e404c78416eca743
-
SSDEEP
24576:h1OYdaOxCZ/iWCvu/2sWsJA/jlt+DHhsY:h1OsXCpYO/dJJDHhsY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ssTjt4ImuYycDlq.exepid process 1052 ssTjt4ImuYycDlq.exe -
Loads dropped DLL 1 IoCs
Processes:
a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exepid process 2036 a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
ssTjt4ImuYycDlq.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcdicehjimghndkacbjlnlfchpgkfao\1.3\manifest.json ssTjt4ImuYycDlq.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcdicehjimghndkacbjlnlfchpgkfao\1.3\manifest.json ssTjt4ImuYycDlq.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcdicehjimghndkacbjlnlfchpgkfao\1.3\manifest.json ssTjt4ImuYycDlq.exe -
Drops file in System32 directory 4 IoCs
Processes:
ssTjt4ImuYycDlq.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy ssTjt4ImuYycDlq.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini ssTjt4ImuYycDlq.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol ssTjt4ImuYycDlq.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI ssTjt4ImuYycDlq.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ssTjt4ImuYycDlq.exepid process 1052 ssTjt4ImuYycDlq.exe 1052 ssTjt4ImuYycDlq.exe 1052 ssTjt4ImuYycDlq.exe 1052 ssTjt4ImuYycDlq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exedescription pid process target process PID 2036 wrote to memory of 1052 2036 a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe ssTjt4ImuYycDlq.exe PID 2036 wrote to memory of 1052 2036 a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe ssTjt4ImuYycDlq.exe PID 2036 wrote to memory of 1052 2036 a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe ssTjt4ImuYycDlq.exe PID 2036 wrote to memory of 1052 2036 a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe ssTjt4ImuYycDlq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe"C:\Users\Admin\AppData\Local\Temp\a4738a8d786f6f1a3405d6fa01610a5e1a8bef4c41b1f84009c4fce2e083e69a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ssTjt4ImuYycDlq.exe.\ssTjt4ImuYycDlq.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ihcdicehjimghndkacbjlnlfchpgkfao\EQdb.jsFilesize
6KB
MD5fe34cb16e8c9c440f98719940cf08f64
SHA19a776a37ad83341a5dbe40e884f61a497c34910a
SHA2569fa748454fbc938cf3c9f4f18e3a581d33ac083d1a579c4e17eb7bd9093db20b
SHA5127e6422620e6f05a0bb9031474ddbb2216c08787c2c2337524c91573a863d6a1d3623f9d723a870864f1e0a6cb3d6efbc60be48a211071bd3592250ef2367154c
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ihcdicehjimghndkacbjlnlfchpgkfao\background.htmlFilesize
141B
MD59d6835b907b9e2a73149f759314cfe84
SHA1cf4d651679ae755d25689430439a12657f6097bc
SHA256cbfb1509e6ca86905ed776a6550bc062ce9724f5df7c1404622b9f91d2eba60c
SHA51267a94ca836f7c6cad9cb002b038aee742aedb12d4c67e643d312f916e08a971cf44199c61e104af8046d65f2e9663bb6caf6b544a6ad393be0213d54e53f71c8
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ihcdicehjimghndkacbjlnlfchpgkfao\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ihcdicehjimghndkacbjlnlfchpgkfao\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ihcdicehjimghndkacbjlnlfchpgkfao\manifest.jsonFilesize
498B
MD5664e2884e17f23553a19eee317642194
SHA1a28ccc088d6b6692646150f3e8f111e568723fb4
SHA256ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191
SHA512b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\chrome.manifestFilesize
35B
MD5a71e8d54d34fbeb01e1a13af599623d8
SHA1dcb508394033dec1dcfe07c0b37499b4cc2341cf
SHA2567929e7c3fa672648bd347b81ebfc6b0c6f11dddbd80e5661c06ca4d1d3d66292
SHA512965f9924d59993ebb0859bce23296cd8212040180a615d2b13c154751a561ede3e7949158af7f3b824eda2b3a4ac5196829e91a0268120d57aee5ea7057439f9
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\content\bg.jsFilesize
9KB
MD5427a1e1dea446616badc758d77b55e5b
SHA10b625203ee6bba66e854e61d485bf14238f83a8a
SHA256a0e7c62f1596fba7b38cfc57fa256cd612861ced6057fcb8b24e9f6f40f8e4d7
SHA5121cbc1a7e535b5f0896a076f47579d77111f952645d58faa9be07090468cb27122df706b78c5ba242767a47ba16137243efa66484406a6d242964e186c1418abf
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\[email protected]\install.rdfFilesize
596B
MD551ec6033a8141b8a394a7cafbe9b967a
SHA121e6aa07bd23cf6af2bc7b367d5df7b591040dc1
SHA256a1ce8cfad5f4459dfc61cf0cadebe9050673999eb05404f68a77acac66638bdd
SHA51283400713a66efc59d1f3236e729b141a03384d45453d5d8e6a7e9938cadaca6f0a29d511392bc1c727e58b24e390f9953a1c1afc4198c50e207c45e4f17bc1a0
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ssTjt4ImuYycDlq.datFilesize
1KB
MD510c9c8fb15df5ed473a2e669d8863665
SHA1e220965c4094c67a03bccde5a6c8573420e76ca1
SHA256efc59bcb1780b3036c6947906370d6c527809282d3c072559219e60f8ae7a047
SHA512c94e380cb3a5f8f3e0e14b82b0cdc3ee3eabe9033f3fb5ee22254578de6d0a441411bba8e9961182b244677b6cfea9ff60cac6cb576932fc6a77c4acf2ad2d98
-
C:\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ssTjt4ImuYycDlq.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
\Users\Admin\AppData\Local\Temp\7zS7946.tmp\ssTjt4ImuYycDlq.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1052-56-0x0000000000000000-mapping.dmp
-
memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB