Analysis
-
max time kernel
8s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:21
Static task
static1
Behavioral task
behavioral1
Sample
a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe
Resource
win7-20221111-en
General
-
Target
a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe
-
Size
949KB
-
MD5
09fcbf73081a506aa332a2227defd363
-
SHA1
9cc4d73503505eeafe0f29b70e37d4f34efc7613
-
SHA256
a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b
-
SHA512
9ea60b2158f2f71940884515d3e972e2802d0b3e553257a775af2c93904c458f000258d6cf0ecc32c7f8fbd37700df2a46c3a5a101c8225e02543c92734abc24
-
SSDEEP
12288:h1OgLdaOktPXN/S0YNynhdujKHZOJVJ7NDIPeRUEXSCUXTzoq39Mrjh1:h1OYdaOYDYQnT7S7NsPeRbSCUXoqtej7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
8rK4GDwUInz0Jrv.exepid process 1400 8rK4GDwUInz0Jrv.exe -
Loads dropped DLL 1 IoCs
Processes:
a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exepid process 1544 a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
8rK4GDwUInz0Jrv.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\djaoecmfnnmbmfmhmlligadpgcimhaif\2.0\manifest.json 8rK4GDwUInz0Jrv.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\djaoecmfnnmbmfmhmlligadpgcimhaif\2.0\manifest.json 8rK4GDwUInz0Jrv.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\djaoecmfnnmbmfmhmlligadpgcimhaif\2.0\manifest.json 8rK4GDwUInz0Jrv.exe -
Drops file in System32 directory 4 IoCs
Processes:
8rK4GDwUInz0Jrv.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 8rK4GDwUInz0Jrv.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 8rK4GDwUInz0Jrv.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 8rK4GDwUInz0Jrv.exe File opened for modification C:\Windows\System32\GroupPolicy 8rK4GDwUInz0Jrv.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
8rK4GDwUInz0Jrv.exepid process 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe 1400 8rK4GDwUInz0Jrv.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
8rK4GDwUInz0Jrv.exedescription pid process Token: SeDebugPrivilege 1400 8rK4GDwUInz0Jrv.exe Token: SeDebugPrivilege 1400 8rK4GDwUInz0Jrv.exe Token: SeDebugPrivilege 1400 8rK4GDwUInz0Jrv.exe Token: SeDebugPrivilege 1400 8rK4GDwUInz0Jrv.exe Token: SeDebugPrivilege 1400 8rK4GDwUInz0Jrv.exe Token: SeDebugPrivilege 1400 8rK4GDwUInz0Jrv.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exedescription pid process target process PID 1544 wrote to memory of 1400 1544 a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe 8rK4GDwUInz0Jrv.exe PID 1544 wrote to memory of 1400 1544 a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe 8rK4GDwUInz0Jrv.exe PID 1544 wrote to memory of 1400 1544 a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe 8rK4GDwUInz0Jrv.exe PID 1544 wrote to memory of 1400 1544 a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe 8rK4GDwUInz0Jrv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe"C:\Users\Admin\AppData\Local\Temp\a3704de6074ca80d4941459c44539fb1e80d2fbfd8d42e7c30d204bf797af70b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\8rK4GDwUInz0Jrv.exe.\8rK4GDwUInz0Jrv.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\8rK4GDwUInz0Jrv.datFilesize
1KB
MD543c87c30cd571a5157728580c14378ee
SHA12d26222c024dc6ffd748090526b93ee9a560b6c1
SHA256247e621b94c606e56c31af99cac0089b777dbd1d8393fab349534802eaaa4183
SHA5124ecadf3cf27491cead9cf2786e13251ac694df416c1761999d6a50f90b4956a14d0ad3c61df5859530324f195f94431d463286ce716df1239a43d326c58982de
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\8rK4GDwUInz0Jrv.exeFilesize
791KB
MD58e78cd4b1c05327f9ce03f037eb2bfd0
SHA1381caf0ead67c72ed9cb5c72fcfbf94b54627c41
SHA25691160eda6fbf13634821b1d73a99ed6348581b31f7d76e888c759139e066baac
SHA5127eeb6945d6fbed1a598d4de34317fc955032382f52457eb9eb8681227a15e22c233d9a2d9d90ceea87535e2dc46d1851aaa0fb3cf69d39e76768e500ec81f249
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\djaoecmfnnmbmfmhmlligadpgcimhaif\background.htmlFilesize
145B
MD54c2f1bf988f1d1675aee87104159efe9
SHA15119e7b841fecf17055ae6373da37de8b77762b4
SHA256654a5df3957813ca616bbd49629bdb33fa6b76890629f9e698e46ec8c6fdb01b
SHA5120ba4d5e775dc42fa1e755c2196f9a2b036307b5817a28687f4084f85c92cc44b2abff95c3d5dd04f8f447e7b6e95b0fec4b27bf227202564688c21a7b3d20aee
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\djaoecmfnnmbmfmhmlligadpgcimhaif\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\djaoecmfnnmbmfmhmlligadpgcimhaif\isLW17Gy.jsFilesize
5KB
MD5891f3d16e18505ad5f192758ee75506d
SHA14227c2890214c4da341d9d96acbf50c46bfb07ee
SHA256fd5d94b591a93260dab043724e62f1c884a15e2cf7cf6bbb25fee8d679614be3
SHA512af9d6b5ab33d806640481beb63718a03f0c3a7676706e094f36589bd72fe7058c9bfa37be7bde685aa36629e2dd8b9a40d25b22a13561d3768937cd3041be7ca
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\djaoecmfnnmbmfmhmlligadpgcimhaif\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\djaoecmfnnmbmfmhmlligadpgcimhaif\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\[email protected]\chrome.manifestFilesize
35B
MD50c196a94d92bd90fc0f199c1afc0e723
SHA11e2ecccf23e33188afbc19c312d6bc07255ee88d
SHA25699c1ebe426f21bb85838c80959080425b507dcf0ef4c8db0e10bbf3048aaabce
SHA512dc8e10b97c01dcd54952ca474114f2d5981222c3cbe97eb3ffba97e8f5614054fecfe03a22ffa66e1ec3dd594c1d05541a7e7bc33817f650f45c0fc56bdbdf20
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5aae81ddc3f86078f58d558d92103428f
SHA1ad1dd9ef9c3b5be9acbc5bd78b523b16e80abe07
SHA2566be6fb8ad1b5429df1e7c1f6f7a5e0ec52d18932f9a2eac836c53fd5cf1c30de
SHA5124e8f2c6771afcccb9b7d1664c43aae032229e2de65f0f0eb386aa2ceaf49ef1a432eda79e559960ceb06fd563b5eab1900f8a2881b5db8dbcab19a22211310f4
-
C:\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\[email protected]\install.rdfFilesize
590B
MD5481913646e5625d1583abd3fa9831fdd
SHA1191cf07b72697b71b21ae97f2ad324db178ac377
SHA2561ab3355343824e09a32fb12026e2b35b7737e85dffb9805cb66b4744398ff350
SHA512352b3899b0aea5bca0f6a23e1a94a7d7ceabdc1d6552b43c2df9fbc8783512ed5a6b070a33bdadba24d30742999cdccdc4f917bbdea9ec1cb765d9edf5e81d09
-
\Users\Admin\AppData\Local\Temp\7zS5F41.tmp\8rK4GDwUInz0Jrv.exeFilesize
791KB
MD58e78cd4b1c05327f9ce03f037eb2bfd0
SHA1381caf0ead67c72ed9cb5c72fcfbf94b54627c41
SHA25691160eda6fbf13634821b1d73a99ed6348581b31f7d76e888c759139e066baac
SHA5127eeb6945d6fbed1a598d4de34317fc955032382f52457eb9eb8681227a15e22c233d9a2d9d90ceea87535e2dc46d1851aaa0fb3cf69d39e76768e500ec81f249
-
memory/1400-56-0x0000000000000000-mapping.dmp
-
memory/1544-54-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB