a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exe
Size

2.5MB
MD5

cd8e36a1513b9f53867386f2bdba1dc6
SHA1

b0ccfdc6dc89403c0a99eb89f0460222444551be
SHA256

a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485
SHA512

f1aa13409671e5ad7afa566be980bd1da949e0aaf49ae918944e312d23df0b2c43bfaf016ce20c8f5dfe406e9bf8142ec22a781108c197fe4dbcb99b21c18a90
SSDEEP

49152:h1OsgyDFXmj+BHBALGk7GNIgSDjjQkzYznJKOZaB/IsxA:h1OD0JSqALGkqaDj7A

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

f0LCbNQnABxIUGs.exe

pid process

4864 f0LCbNQnABxIUGs.exe
Loads dropped DLL 3 IoCs

Processes:

f0LCbNQnABxIUGs.exeregsvr32.exeregsvr32.exe

pid process

4864 f0LCbNQnABxIUGs.exe
4952 regsvr32.exe
4468 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4864	f0LCbNQnABxIUGs.exe

pid	process
4864	f0LCbNQnABxIUGs.exe
4952	regsvr32.exe
4468	regsvr32.exe

Drops Chrome extension 5 IoCs

Processes:

f0LCbNQnABxIUGs.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmjclojafmpkmafeidjbgeeohoblhao\2.0\manifest.json	f0LCbNQnABxIUGs.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmjclojafmpkmafeidjbgeeohoblhao\2.0\manifest.json	f0LCbNQnABxIUGs.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmjclojafmpkmafeidjbgeeohoblhao\2.0\manifest.json	f0LCbNQnABxIUGs.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmjclojafmpkmafeidjbgeeohoblhao\2.0\manifest.json	f0LCbNQnABxIUGs.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmjclojafmpkmafeidjbgeeohoblhao\2.0\manifest.json	f0LCbNQnABxIUGs.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

f0LCbNQnABxIUGs.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	f0LCbNQnABxIUGs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	f0LCbNQnABxIUGs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	f0LCbNQnABxIUGs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	f0LCbNQnABxIUGs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

f0LCbNQnABxIUGs.exe

description	ioc	process
File created	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.tlb	f0LCbNQnABxIUGs.exe
File opened for modification	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.tlb	f0LCbNQnABxIUGs.exe
File created	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.dat	f0LCbNQnABxIUGs.exe
File opened for modification	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.dat	f0LCbNQnABxIUGs.exe
File created	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll	f0LCbNQnABxIUGs.exe
File opened for modification	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll	f0LCbNQnABxIUGs.exe
File created	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.dll	f0LCbNQnABxIUGs.exe
File opened for modification	C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.dll	f0LCbNQnABxIUGs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f0LCbNQnABxIUGs.exe

pid process

4864 f0LCbNQnABxIUGs.exe
4864 f0LCbNQnABxIUGs.exe

pid	process
4864	f0LCbNQnABxIUGs.exe
4864	f0LCbNQnABxIUGs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exef0LCbNQnABxIUGs.exeregsvr32.exe

description	pid	process	target process
PID 4804 wrote to memory of 4864	4804	a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exe	f0LCbNQnABxIUGs.exe
PID 4804 wrote to memory of 4864	4804	a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exe	f0LCbNQnABxIUGs.exe
PID 4804 wrote to memory of 4864	4804	a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exe	f0LCbNQnABxIUGs.exe
PID 4864 wrote to memory of 4952	4864	f0LCbNQnABxIUGs.exe	regsvr32.exe
PID 4864 wrote to memory of 4952	4864	f0LCbNQnABxIUGs.exe	regsvr32.exe
PID 4864 wrote to memory of 4952	4864	f0LCbNQnABxIUGs.exe	regsvr32.exe
PID 4952 wrote to memory of 4468	4952	regsvr32.exe	regsvr32.exe
PID 4952 wrote to memory of 4468	4952	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exe
"C:\Users\Admin\AppData\Local\Temp\a8d3cfc685b4b18eb5b1b52830c7103b5d694c102b722c7f65c39cdc79069485.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\f0LCbNQnABxIUGs.exe
.\f0LCbNQnABxIUGs.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.dat
Filesize
6KB

MD5
4f53445fe60017bdb89a830be57d7c76

SHA1
4bd45453cdbcdaf3fc6d7bcc63b8823066d6fb00

SHA256
19c1d5c47ab4af8d7fed6a5510bbdf522fbf43f81dfed67ebd35961fe1772548

SHA512
e79b64d8c3b3110e7d1c0516972cd10e3f811793343a36cf4ba3576961ea51bea91a728136807d176efbb765b021b4514539fc9039e3f147a90ae05e1d79f0a4

Download Submit
C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.dll
Filesize
749KB

MD5
05636af3aa9a36a4a1df7560231b520c

SHA1
94b0fb3246f9d757a44cc80401bab6720f7f5fb3

SHA256
2c8c222a335b7872c49a0a0185d5cbf29481c8364e1d5d822afa532cfa77ee10

SHA512
e8d8e47faf9d357cfae6c8e515426787111b2c4602390d7cc1eda04485a436ca7013c89061887fe45da2566c5dd2e1e04599af270062379b37444985d1f1d07c

Download Submit
C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll
Filesize
886KB

MD5
eadda36c5638e64e055ca60e50caf427

SHA1
822ae0491b2897790cb3e10920836e2ea40696e1

SHA256
419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff

SHA512
60fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2

Download Submit
C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll
Filesize
886KB

MD5
eadda36c5638e64e055ca60e50caf427

SHA1
822ae0491b2897790cb3e10920836e2ea40696e1

SHA256
419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff

SHA512
60fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2

Download Submit
C:\Program Files (x86)\GoSave\cAW9cU0FMzlA66.x64.dll
Filesize
886KB

MD5
eadda36c5638e64e055ca60e50caf427

SHA1
822ae0491b2897790cb3e10920836e2ea40696e1

SHA256
419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff

SHA512
60fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
6cb690fdf207ed518ea8d106656ace77

SHA1
9fc396064da93a6110235a43c286f75c03082e82

SHA256
3198b87e18359c47f0719c3479837934fd0b69c99b2a4162aab2ab6eabfa8a8a

SHA512
03ed6ad288ca32e420a697bb11fe77d65d4f831aec7407513ac3c1c8a034a2608af7b51ecd9672ae6d12b452d21c017064c5a45ea14418e08357e529b2f45c53

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\[email protected]\content\bg.js
Filesize
7KB

MD5
03a6dee4e5f8713eff826b5695d26d04

SHA1
c4a6b2c6eba9c15e2b9e56d52efc86b6fc20702d

SHA256
8b4fec4e3c6324e0db7be83a0b7119231463ba76f9c503582133a65a3941567e

SHA512
95f33aca327079974c0e9010ee0ccbbd95bcadd33b98ba7a87a2105bf1ccad5c6947a95a10ea88bef58038126e849f9592225efd08fb54f3ff2cb183cfbf5ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\[email protected]\install.rdf
Filesize
592B

MD5
f098983e1904ad5b1fdd1e631baba320

SHA1
bada3352c0374bb489f5517d0c0632914fe3658e

SHA256
d20a05c27d9d6a10540260d5eedaba3ab9245ac739fecef2dd0710a4ae9ca530

SHA512
e60767ccf23cfb993991334543616bc310b3f593738fd361b073d86439227c73432c0d060a8d09fa4f4d1c444f0b500a3c364475253593b1dcb5e839af8d55db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\cAW9cU0FMzlA66.dll
Filesize
749KB

MD5
05636af3aa9a36a4a1df7560231b520c

SHA1
94b0fb3246f9d757a44cc80401bab6720f7f5fb3

SHA256
2c8c222a335b7872c49a0a0185d5cbf29481c8364e1d5d822afa532cfa77ee10

SHA512
e8d8e47faf9d357cfae6c8e515426787111b2c4602390d7cc1eda04485a436ca7013c89061887fe45da2566c5dd2e1e04599af270062379b37444985d1f1d07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\cAW9cU0FMzlA66.tlb
Filesize
3KB

MD5
aafd1d71b2778cd2369e1a2d7e7166d1

SHA1
f6505a389d7e2be9d3ccc3ea4e052abc338fcbb5

SHA256
b3772533d10176e84e6b87269bb0ab4dd783f34baa17eb2a7ad42078a2203e1c

SHA512
df4ef691872946fb4bfebc6ce3699f56fc4c5846c1a8de6b16296717ef4f41b8e5b32c43e8dd56fe46731a91da93684889e78d42a92fa37eb38622d1d71353a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\cAW9cU0FMzlA66.x64.dll
Filesize
886KB

MD5
eadda36c5638e64e055ca60e50caf427

SHA1
822ae0491b2897790cb3e10920836e2ea40696e1

SHA256
419d87b1e4cfdb1e6fc4bbaa8c05bdeec5bb2c1afe87544fe78aa875013a9cff

SHA512
60fc2b64a30a972adfa94cfdd308887c590a8c15bc90b0a55692a860c6ca15cfe3fc7237102d7860bfd65764d479d37e62f0b09f94b4e3c76463821c6148cbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\f0LCbNQnABxIUGs.dat
Filesize
6KB

MD5
4f53445fe60017bdb89a830be57d7c76

SHA1
4bd45453cdbcdaf3fc6d7bcc63b8823066d6fb00

SHA256
19c1d5c47ab4af8d7fed6a5510bbdf522fbf43f81dfed67ebd35961fe1772548

SHA512
e79b64d8c3b3110e7d1c0516972cd10e3f811793343a36cf4ba3576961ea51bea91a728136807d176efbb765b021b4514539fc9039e3f147a90ae05e1d79f0a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\f0LCbNQnABxIUGs.exe
Filesize
769KB

MD5
926d03f373e2f0d6ecf16e30c941ad60

SHA1
b5caf80c04b62525774f66262ce6b1ebeaa19315

SHA256
b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847

SHA512
6aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\f0LCbNQnABxIUGs.exe
Filesize
769KB

MD5
926d03f373e2f0d6ecf16e30c941ad60

SHA1
b5caf80c04b62525774f66262ce6b1ebeaa19315

SHA256
b14f3bb56383bbb14a4341fd60674a9fc62505a69413ec25b9ff8dade8c63847

SHA512
6aa4ade944470239569b56f7556df747c92218051a540e4d86006510cdee374718c7facc0f6089b5027b08aa728fc98538799d65343aef608ed91a704105a4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\fpmjclojafmpkmafeidjbgeeohoblhao\DvdCq3rB.js
Filesize
5KB

MD5
16208f4fdf03c985aecc38559f0ba456

SHA1
05db3d4afd4897ad4d49b35a47ee6eba7515e251

SHA256
2984703852184501f80c1461e3bca16aecf7e98746e9a875f3a901975944d2e0

SHA512
34a33f736cc3b202f90e3276c76b99086e64c11f345db8937775ff8eadb08bc322db59a8166112b125618b93f75d3bd4eabed90fbf9555430a6e542d514f090c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\fpmjclojafmpkmafeidjbgeeohoblhao\background.html
Filesize
145B

MD5
adebfc7127dd441f3050c4f57e59888e

SHA1
51419f0c05adfdab4c44b968767d28931b6b5643

SHA256
06ae07d998b038cee793c69236eccc8c9e22d367bea26084538bc2a58211808a

SHA512
70f41b0139aad4bf993f3da474ab4ff862ad95bf9e16e3d9f40b9a3b084b4f162c767e2d066c132cea3da2a45daeff7c55e9347b889a21ec6ef9be8faeecff93

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\fpmjclojafmpkmafeidjbgeeohoblhao\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\fpmjclojafmpkmafeidjbgeeohoblhao\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF561.tmp\fpmjclojafmpkmafeidjbgeeohoblhao\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/4468-152-0x0000000000000000-mapping.dmp

Download
memory/4864-132-0x0000000000000000-mapping.dmp

Download
memory/4952-149-0x0000000000000000-mapping.dmp

Download