Analysis
-
max time kernel
14s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe
Resource
win7-20221111-en
General
-
Target
a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe
-
Size
931KB
-
MD5
b2653d10ab487bc280f73b72ab937e9b
-
SHA1
435906f02afb95d319a1eadfbb28b7e4ab492e9a
-
SHA256
a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d
-
SHA512
0ec0b371f9cd24f91893ca0cb9af92f79ed880ed06571c51c102186de6d05425590decfae3cd66f987727dc4305e91beaa88c764c530d38c2757963937b6d91e
-
SSDEEP
24576:h1OYdaO8CZ/iWCvu/2sWsJA/jlt+DHhsf:h1OseCpYO/dJJDHhsf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
IUrDKgObPybPaUK.exepid process 976 IUrDKgObPybPaUK.exe -
Loads dropped DLL 1 IoCs
Processes:
a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exepid process 1092 a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
IUrDKgObPybPaUK.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddlpmmhcnlhmanocabojdnglooflkhi\2.0\manifest.json IUrDKgObPybPaUK.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddlpmmhcnlhmanocabojdnglooflkhi\2.0\manifest.json IUrDKgObPybPaUK.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddlpmmhcnlhmanocabojdnglooflkhi\2.0\manifest.json IUrDKgObPybPaUK.exe -
Drops file in System32 directory 4 IoCs
Processes:
IUrDKgObPybPaUK.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy IUrDKgObPybPaUK.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini IUrDKgObPybPaUK.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol IUrDKgObPybPaUK.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI IUrDKgObPybPaUK.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
IUrDKgObPybPaUK.exepid process 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe 976 IUrDKgObPybPaUK.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
IUrDKgObPybPaUK.exedescription pid process Token: SeDebugPrivilege 976 IUrDKgObPybPaUK.exe Token: SeDebugPrivilege 976 IUrDKgObPybPaUK.exe Token: SeDebugPrivilege 976 IUrDKgObPybPaUK.exe Token: SeDebugPrivilege 976 IUrDKgObPybPaUK.exe Token: SeDebugPrivilege 976 IUrDKgObPybPaUK.exe Token: SeDebugPrivilege 976 IUrDKgObPybPaUK.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exedescription pid process target process PID 1092 wrote to memory of 976 1092 a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe IUrDKgObPybPaUK.exe PID 1092 wrote to memory of 976 1092 a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe IUrDKgObPybPaUK.exe PID 1092 wrote to memory of 976 1092 a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe IUrDKgObPybPaUK.exe PID 1092 wrote to memory of 976 1092 a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe IUrDKgObPybPaUK.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe"C:\Users\Admin\AppData\Local\Temp\a46e377ba14a47f35ea34039e0ef24b3faf8c598503e0cb9065577e2999e856d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\IUrDKgObPybPaUK.exe.\IUrDKgObPybPaUK.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\IUrDKgObPybPaUK.datFilesize
1KB
MD56571bd4983e33bd847336d7bb723e464
SHA1c3b051bfac4016b710bc7bcc1c782ec05d1ff225
SHA256e20716b51fdfe004b12967fb0d56ea4935028e97b1030fc43290f720d9ecbd51
SHA5126fb33de83a60c919f99de0ae237c3bc4d02c59f7767923277bd5fe5d7a6bb271f93a3ee167b820c7859516e29e6e6732f8c3740c59901f2512ff5b7698ab2a52
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\IUrDKgObPybPaUK.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\jddlpmmhcnlhmanocabojdnglooflkhi\NQVKs8SX.jsFilesize
6KB
MD55f0202c34fb92290d8979dc4813afe20
SHA1bf7d08c9901770365c11313b27dd58d0948cb158
SHA256099220460511adab387cfd91dd370bd0dfb98aafd61a5bc5fcec068e4fdde5cc
SHA51250537682bb5fcaece1a357709dd74e9445390aa2c04ddecced4097c0794c1dce258d4b5b3cc2a79d21feafbe82b0f44c5bb6e1bbdd83b1c8e214a56b798e77d6
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\jddlpmmhcnlhmanocabojdnglooflkhi\background.htmlFilesize
145B
MD59af79524de70f874b73ec82256a0213b
SHA1d436b5d0020266802da460b1770a10f839194695
SHA2565f82846c7cc7a332792857275912c932a6d86d5abeed0ae38b6da8ed2bbf78cb
SHA51277f0293401f977606a71f02a6d33f4692766a2f40ed9166c5318174f1508c1fc99261edfc86e0a295a636fc80015085f80f3c02bb27f9782b6974df3b5d54dc0
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\jddlpmmhcnlhmanocabojdnglooflkhi\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\jddlpmmhcnlhmanocabojdnglooflkhi\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\jddlpmmhcnlhmanocabojdnglooflkhi\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\[email protected]\chrome.manifestFilesize
35B
MD5808d398d0ffdbee884c65643c27d04b5
SHA18a8d43529814879e4f33889517829624c293bf83
SHA2564f589edf9f880e33d032b80fe95bb2d2b7f3fa896f24ef0b73e85a55b81ce24e
SHA51249bed7c6d41ec40786cbbd5f8e9050728ca1bb02ad799ccd7f2096b3bae2541ec20f09e3b4a9e26da96d8d7eaf09aeff426ddfbc4da327b6b5bfdf20203baace
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\[email protected]\content\bg.jsFilesize
8KB
MD59b4a87223138f185fdd156725577faec
SHA125734da51f591fff59ca8289480d6a7add25dc4b
SHA2563a8f0058f68d3376f5125794294bab32eae41ad6b489499c53460b0a0d0e31db
SHA5129fc9a444effe703de60c91c26dca5f7fcb49fdb4dc0fa4894aa73cecf2a1e103e62fba86c7a508dd50275df81fd2b8bc8f4231316a712134190f6d7a14b3c454
-
C:\Users\Admin\AppData\Local\Temp\7zS5449.tmp\[email protected]\install.rdfFilesize
598B
MD587e5cbfad0beb3ea4adacb8eb85612b2
SHA1bdcbd498ef4d8404a4963077a8949b0f7a719298
SHA256f3f8a72b5ec20e8cd7d5bcac122a317953f5e606e2529b2f8653fcbd786e0070
SHA5129f2ff305b6b827997eeb51b2ab3fa89220d35880c369d94648a5d9177ef560405b5a907f8c9e4acc29548c59a8011b5eedbac3791eed86db53bae3dd7fd46204
-
\Users\Admin\AppData\Local\Temp\7zS5449.tmp\IUrDKgObPybPaUK.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/976-56-0x0000000000000000-mapping.dmp
-
memory/1092-54-0x0000000075E61000-0x0000000075E63000-memory.dmpFilesize
8KB