abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427

Analysis

max time kernel
174s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe
Size

931KB
MD5

c5df4b6a4a306c53c4203d9e1653b558
SHA1

291a81188f747273da9e9a7df44d6e9a5c17b9d4
SHA256

abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427
SHA512

dd169889e549b9c3c71457349d9b78bd7f1267ca9c11e1f9c2ada49733d8885c9986809fe282e11342e46655f630fb4e9f38a14567d83232cb6b4cd88e6918e0
SSDEEP

24576:h1OYdaOJCZ/iWCvu/2sWsJA/jlt+DHhsl:h1OsvCpYO/dJJDHhsl

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

cvg4v1TKNsI9qUW.exe

pid process

5004 cvg4v1TKNsI9qUW.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

cvg4v1TKNsI9qUW.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibfdagdamgcleglndmkfjclnocakeebg\1.3\manifest.json	cvg4v1TKNsI9qUW.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibfdagdamgcleglndmkfjclnocakeebg\1.3\manifest.json	cvg4v1TKNsI9qUW.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibfdagdamgcleglndmkfjclnocakeebg\1.3\manifest.json	cvg4v1TKNsI9qUW.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibfdagdamgcleglndmkfjclnocakeebg\1.3\manifest.json	cvg4v1TKNsI9qUW.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibfdagdamgcleglndmkfjclnocakeebg\1.3\manifest.json	cvg4v1TKNsI9qUW.exe

Drops file in System32 directory 4 IoCs

Processes:

cvg4v1TKNsI9qUW.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	cvg4v1TKNsI9qUW.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	cvg4v1TKNsI9qUW.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	cvg4v1TKNsI9qUW.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	cvg4v1TKNsI9qUW.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

cvg4v1TKNsI9qUW.exe

pid	process
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe
5004	cvg4v1TKNsI9qUW.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe

description	pid	process	target process
PID 552 wrote to memory of 5004	552	abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe	cvg4v1TKNsI9qUW.exe
PID 552 wrote to memory of 5004	552	abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe	cvg4v1TKNsI9qUW.exe
PID 552 wrote to memory of 5004	552	abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe	cvg4v1TKNsI9qUW.exe

C:\Users\Admin\AppData\Local\Temp\abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe
"C:\Users\Admin\AppData\Local\Temp\abaac5dbba2aa2e2b08ca683e69d5129dcef557097ccc2f3213581f5c7811427.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\cvg4v1TKNsI9qUW.exe
.\cvg4v1TKNsI9qUW.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
4dab6fbef1f4b67506d129c5e8e87776

SHA1
b601d77e8148e33994ce76ec0e6670933cc7e252

SHA256
03f9b79d32495ff23a1e95d93368cc5a9c28354cc1eac369aec6bbf0abaad672

SHA512
bc336e6d3b456a226bda9dcd8aa9b6ac74b19f35a87b5d06263830537517a78a2cacad3975013a55cbbeb08c4c9b75672a16987b57b8bd0180975f7140aa5a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
108eb464800a42e5c79f216168a46fc8

SHA1
3c5a5ae14df4f6d6011ae8eadd3700fea41c27bf

SHA256
3f5325d11568ad2db443129456b1e463791b7777215ac4cd2172953dd4215942

SHA512
2588fb6eb87255a08c6f91be71624a35a98bdcace33df8ba4551872d67f502925922f69f2d5e77e4363dff87f417d04cb4eed47aea126e1ba67e5ac745e319c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\[email protected]\install.rdf

Filesize
594B

MD5
1336d052458ca4018b7d695e7c4c0c0d

SHA1
409048cd13f73a7f543add006376931675726138

SHA256
3480e68360d5143da80e3a8a8afadaf265cc7b1bd7418d2fe789ea091d98a8b1

SHA512
70b2e06d57cb22f927a149f41c683eb32d9538993581bc7834c651708116c2ec872b26774ecfa33f2a57cc2ede30671d7981e8fa886b0dab86a7e39349290dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\cvg4v1TKNsI9qUW.dat

Filesize
1KB

MD5
ce7d812434213f154955d510c4330405

SHA1
7dc9cfbf295e55b26d7aedcb2048b4e157cc1140

SHA256
a17a8bcfc29d9cd22c68da9f5b05d3351fae62e6c2fb3ed96318f8af339c90e3

SHA512
6d9ea94058a6fd373df4779366424fa95015d1dc9ed137d640f160e13ff5b8298b6988a5fcf996fd1c96dd6847fd9e85e20975cd0ac167c461b2ac05c1b61dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\cvg4v1TKNsI9qUW.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\cvg4v1TKNsI9qUW.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\ibfdagdamgcleglndmkfjclnocakeebg\background.html

Filesize
138B

MD5
b566a7b485f09aa71608552679b7bdfb

SHA1
fcdc8805206820a2cd7d43d31b104088de594f4b

SHA256
fbcf0e9cbb35c1133503b638b1d971099cd542daee708dc4ccc13908fea9f5f6

SHA512
5a27fd0c21a282cd034ce7ec848966259f5e5d7ba077404399bb7ff7f2d189354e3c25c5c4eb6f5e9f5a9b16bb4a139db375cd9d21de68e9e2cbbd104844b333

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\ibfdagdamgcleglndmkfjclnocakeebg\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\ibfdagdamgcleglndmkfjclnocakeebg\k.js

Filesize
6KB

MD5
99a3912e462b15787f448c4daaf4a0c2

SHA1
1e610ba30195506502a63c5cf7e0f442561af691

SHA256
ab8b9b6e36c5b15e5431a834d59d90dce3fd207067ca4a0008544ed0bf8dcc60

SHA512
e7cf9dc12d325a0e6ee384daa83489247694e2bcb5abe414fc7444906f584ff82cb79c2618b481e710f02329fe6c0f7b9090f294d47bfd7ac68f762f7752571f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\ibfdagdamgcleglndmkfjclnocakeebg\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC6CF.tmp\ibfdagdamgcleglndmkfjclnocakeebg\manifest.json

Filesize
498B

MD5
664e2884e17f23553a19eee317642194

SHA1
a28ccc088d6b6692646150f3e8f111e568723fb4

SHA256
ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

SHA512
b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

Download Submit
memory/5004-132-0x0000000000000000-mapping.dmp

Download