ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe
Size

920KB
MD5

08ff5930fcc017c64472e6fb2afb3f6a
SHA1

cf847c5080d36fb92404f9f3de299e3897ee906f
SHA256

ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c
SHA512

21a63ade03f74c3463949d3b85432899e449328fd2c8fbf71b6b90bb21995b0873afa606d1158cf0839706fc08ee7c4caecaf9ad22fe243c4f547dada32c09c5
SSDEEP

24576:h1OYdaOTMtdHAqcdDVhYwiei7+EpFAh/kKu:h1Os2PHVmVhYwiLtKkKu

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

fGtGmSmQb0GuZ4i.exe

pid process

1284 fGtGmSmQb0GuZ4i.exe
Loads dropped DLL 1 IoCs

Processes:

ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe

pid process

1952 ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1952	ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe

Drops Chrome extension 3 IoCs

Processes:

fGtGmSmQb0GuZ4i.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lonmkffngdjnccikbfcbnkdilbejafbd\2.0\manifest.json	fGtGmSmQb0GuZ4i.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lonmkffngdjnccikbfcbnkdilbejafbd\2.0\manifest.json	fGtGmSmQb0GuZ4i.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lonmkffngdjnccikbfcbnkdilbejafbd\2.0\manifest.json	fGtGmSmQb0GuZ4i.exe

Drops file in System32 directory 4 IoCs

Processes:

fGtGmSmQb0GuZ4i.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	fGtGmSmQb0GuZ4i.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	fGtGmSmQb0GuZ4i.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	fGtGmSmQb0GuZ4i.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	fGtGmSmQb0GuZ4i.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

fGtGmSmQb0GuZ4i.exe

pid	process
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe
1284	fGtGmSmQb0GuZ4i.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fGtGmSmQb0GuZ4i.exe

description	pid	process
Token: SeDebugPrivilege	1284	fGtGmSmQb0GuZ4i.exe
Token: SeDebugPrivilege	1284	fGtGmSmQb0GuZ4i.exe
Token: SeDebugPrivilege	1284	fGtGmSmQb0GuZ4i.exe
Token: SeDebugPrivilege	1284	fGtGmSmQb0GuZ4i.exe
Token: SeDebugPrivilege	1284	fGtGmSmQb0GuZ4i.exe
Token: SeDebugPrivilege	1284	fGtGmSmQb0GuZ4i.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe

description	pid	process	target process
PID 1952 wrote to memory of 1284	1952	ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe	fGtGmSmQb0GuZ4i.exe
PID 1952 wrote to memory of 1284	1952	ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe	fGtGmSmQb0GuZ4i.exe
PID 1952 wrote to memory of 1284	1952	ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe	fGtGmSmQb0GuZ4i.exe
PID 1952 wrote to memory of 1284	1952	ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe	fGtGmSmQb0GuZ4i.exe

C:\Users\Admin\AppData\Local\Temp\ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe
"C:\Users\Admin\AppData\Local\Temp\ab66b918ac344db784537ce53f274716739a7065a853fc842da0ce11d906896c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\fGtGmSmQb0GuZ4i.exe
.\fGtGmSmQb0GuZ4i.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\fGtGmSmQb0GuZ4i.dat

Filesize
1KB

MD5
222d41e4999de477248aaa97d37bfb78

SHA1
c8f0bf1bae61d1431cfcf9878ed37901eed1ef8d

SHA256
28478fed53f6df04c2afd3323f9a2fb5b125eed82e0103ea39ff1eab364f37f7

SHA512
828485aa6bb4c95bd8b2e6e09e6931d67154740390b927adc9f7f568d097a833ed4ff30e3a042938ad234dab88c32c4633fe693c5b9ba75b008b5e724cac674f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\fGtGmSmQb0GuZ4i.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
23fffe182127bd2a7e3a446800b384c7

SHA1
eac984b4d4e4a5f51efd631271f41a97ef2a7ccb

SHA256
78a9e662e9f322d036a0f456415e687b82bab656bc0bf655f11e0769c86c4816

SHA512
a14fff9224a2363316f4ee60c85977a0ef3e5b8ae6002dedb1ad95681d3502dd2a7c12b6cca0d77a2de6b7d3635d3e2de1cbba5fbf8681804568a1ba27cbdd77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
4eca30a51d15a10a160c1d61267b32b4

SHA1
4092a5ceafe5fc1f1f61b46c8ed9f4e20c211a0a

SHA256
63dab5e50bc240615584040f028a7cc6f8b3223ed0255d89e676e3a3554aef03

SHA512
044a25073e65def3ac3d688114db241d372bd6b4dfb8d0e1cd93631917b373b3ba307706004ab1f645a452de965ab40514b4972cb6c78a9d81303cd2ce64deea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\[email protected]\install.rdf

Filesize
597B

MD5
0d4e09931946e7a5cbf179f3eb3d1c0d

SHA1
97ded6789821002da6d4996a9f7ae032d645489f

SHA256
cd79fe9c9037c6ddb73fa391daf6743141fff1f8d1b4a3e525f16b7e22152e4c

SHA512
c387330f66307dd185732ba3d125f7056e94c74765f5dc2a8292e1fc1018c2a5e8c01a572359bc6b7eea577790675708e5df6db35d038062c33a99a5d3bdb03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\lonmkffngdjnccikbfcbnkdilbejafbd\background.html

Filesize
146B

MD5
64cf8e07e487abe90e750e4778d68084

SHA1
c8233330563cd688f546496a572592af1257b547

SHA256
2fb36ce39fa5fb543f0a102e47c28508f325f943c1b6b90e458ea143187fc32d

SHA512
bc4a7c9279659c1d1bf6ddf3743f526ef410c03b4347163e7228e42f1962547a05ded461ca77a4ed14508d47709f09584e1dc0da627cd56c2669006fe8e038f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\lonmkffngdjnccikbfcbnkdilbejafbd\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\lonmkffngdjnccikbfcbnkdilbejafbd\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\lonmkffngdjnccikbfcbnkdilbejafbd\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\lonmkffngdjnccikbfcbnkdilbejafbd\nw9bFCBZS.js

Filesize
6KB

MD5
b5ab935407e61a18213db8a9be3af01b

SHA1
f7885704de8842911f9965603ad5ad7e219441fe

SHA256
dfc3bf3a3e9c14cf312af97eb4c86a15ec7318b8525b01322d9f9563fa4eaf23

SHA512
2f7aeceedb7ef5a44666590ed6cfb2adbc337769b516def1120da96f9fc06b81482b7a16f4fffd18b33ac2af8b5957da26991ca03c021f1f1ff7f93cf60b5ca5

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2EDE.tmp\fGtGmSmQb0GuZ4i.exe

Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/1284-56-0x0000000000000000-mapping.dmp

Download
memory/1952-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download