ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8

Analysis

max time kernel
161s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe
Size

931KB
MD5

69e950ba3f20eefe727643bf92b25922
SHA1

938f120f3c515666ff072d50d6255ed5dbcc8222
SHA256

ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8
SHA512

3e5a1a16c48bc3857798f686eaea68120af8577bbfacbe3186de573c47a8084060012596925d39c49ea8c53313dc002235b5a0bfe6fe5e10f8fedf8da9b3f154
SSDEEP

24576:h1OYdaOACZ/iWCvu/2sWsJA/jlt+DHhs6:h1OsKCpYO/dJJDHhs6

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

zrQzCeemibdA5gH.exe

pid process

1156 zrQzCeemibdA5gH.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

zrQzCeemibdA5gH.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlbfdfmgbpdkombfjlgnahbhbofpeogn\2.0\manifest.json	zrQzCeemibdA5gH.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlbfdfmgbpdkombfjlgnahbhbofpeogn\2.0\manifest.json	zrQzCeemibdA5gH.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlbfdfmgbpdkombfjlgnahbhbofpeogn\2.0\manifest.json	zrQzCeemibdA5gH.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlbfdfmgbpdkombfjlgnahbhbofpeogn\2.0\manifest.json	zrQzCeemibdA5gH.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlbfdfmgbpdkombfjlgnahbhbofpeogn\2.0\manifest.json	zrQzCeemibdA5gH.exe

Drops file in System32 directory 4 IoCs

Processes:

zrQzCeemibdA5gH.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	zrQzCeemibdA5gH.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	zrQzCeemibdA5gH.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	zrQzCeemibdA5gH.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	zrQzCeemibdA5gH.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

zrQzCeemibdA5gH.exe

pid	process
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe
1156	zrQzCeemibdA5gH.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

zrQzCeemibdA5gH.exe

description	pid	process
Token: SeDebugPrivilege	1156	zrQzCeemibdA5gH.exe
Token: SeDebugPrivilege	1156	zrQzCeemibdA5gH.exe
Token: SeDebugPrivilege	1156	zrQzCeemibdA5gH.exe
Token: SeDebugPrivilege	1156	zrQzCeemibdA5gH.exe
Token: SeDebugPrivilege	1156	zrQzCeemibdA5gH.exe
Token: SeDebugPrivilege	1156	zrQzCeemibdA5gH.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe

description	pid	process	target process
PID 5024 wrote to memory of 1156	5024	ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe	zrQzCeemibdA5gH.exe
PID 5024 wrote to memory of 1156	5024	ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe	zrQzCeemibdA5gH.exe
PID 5024 wrote to memory of 1156	5024	ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe	zrQzCeemibdA5gH.exe

C:\Users\Admin\AppData\Local\Temp\ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe
"C:\Users\Admin\AppData\Local\Temp\ae656ba0f583472e6dccacbb2bbd2ba4ca7671557d3ab402139550dc799da6f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\zrQzCeemibdA5gH.exe
.\zrQzCeemibdA5gH.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
5e4da4fddf08c2ac3be027dd7b5aee83

SHA1
2502a2520573380f4c1d175fd29836e43bddf662

SHA256
6a1ad22f1e402f49001d8a09bb4e72dabd2c48f63be134055e1167f7a99cc020

SHA512
7abe4d08f1543a0cae7759042bb7cd235da68d58e50ebafb3f9f10435ec59bae6e5032c7cf34ef4a86084c1da7d6c16a55b76aa69204b6fc1879d46f34fe34d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
cfed063fc59e548478bb95cce937fe11

SHA1
35fc27ac799f728b473a3cddb3190ddf647ac69b

SHA256
64741359dd9b9c167017eb981963347b0c3258279d233984f7eb95ab78161f74

SHA512
ef69a37d8532d771463c3dc8f3c8ded962bde1d462f5b411637dc27e87ee396ff0acc852b2768501d79993cf806bc6e4d0d205c7d224fb389bd2cb54c53178c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\[email protected]\install.rdf

Filesize
597B

MD5
f4165477a77ef45fc92cfd12dd067143

SHA1
4d08baed3f8663a1005bc476d17c55c5466fe075

SHA256
0ce59f706109fd6e099b13016fbcf20d1f0215c17d2b163917a3c7499ca3db0e

SHA512
f1e33334a1e7572dfd42fda05feed19d2b5e218e88227c04253adc9f959173dbf07c3f80c56095b581788b6d4e704160913fc2bc21af20aefbf67b34a0831a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\mlbfdfmgbpdkombfjlgnahbhbofpeogn\background.html

Filesize
143B

MD5
d42967b84c685e98c9517c0e7dd73a46

SHA1
5a82a75d26f8eccb175e62ba27f9cbb7546e5700

SHA256
9351db5e3b341c3b2c63d23ebbcfdc8bd91920db47e961696f03a12e36a2afaa

SHA512
96bfa55cb912748f506417caa1fa9b69ba45a049e715b75be52d645a319625a71c90a478bd5c644d2e1059f875784d8706a10135f3ce14bf59e42c1111495840

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\mlbfdfmgbpdkombfjlgnahbhbofpeogn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\mlbfdfmgbpdkombfjlgnahbhbofpeogn\k6TgOs.js

Filesize
6KB

MD5
f7072879e1bca5a9f2c2c41530580eaf

SHA1
fca70d6b7ff16ac887185caed038497b219eb1e0

SHA256
0aced576c58b213c3bd342033a9d453a7ba619c98c3f48088c703ab57e218df9

SHA512
8d6c099953ff6866172c34398a8098d672fbd9baaa2603036e8ee7d100b8c6678d3ebb584d9a4aae7b0a6406e20f7d9fb6135e4e64b3040c21d2a95b68b05aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\mlbfdfmgbpdkombfjlgnahbhbofpeogn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\mlbfdfmgbpdkombfjlgnahbhbofpeogn\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\zrQzCeemibdA5gH.dat

Filesize
1KB

MD5
713cf46aadfb4ecf0ee19b10bb183a04

SHA1
96adf61f01cb8e770c1f284d6b66bdfc625be2bb

SHA256
f6b70a51675839bd6d0fe89100805e0ff56e06220e7d821af5485d54f0769a6c

SHA512
ff83e583bb15e3b339d0f08d3ddb295726682130275764c4207894764b48a18f61d7e213ada738ec266e547abf8cf2c19f3152d089db837babb61c584de9971b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\zrQzCeemibdA5gH.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF462.tmp\zrQzCeemibdA5gH.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/1156-132-0x0000000000000000-mapping.dmp

Download