Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:04
Static task
static1
Behavioral task
behavioral1
Sample
a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe
Resource
win7-20221111-en
General
-
Target
a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe
-
Size
920KB
-
MD5
ce3fa0c175863417a09bebb91a722ac5
-
SHA1
a2975978f480399d5efcb1ce6765abfc8d0249c1
-
SHA256
a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8
-
SHA512
5470a5eef135e0971196f6761a8573beaa44d502399cfbfb2e9325430f1a466a0a2c43215168bfef16d05d8f4f13b91356bf49c311b9b2cac13d1b9510dfc77a
-
SSDEEP
24576:h1OYdaOvMtdHAqcdDVhYwiei7+EpFAh/kKk:h1OsmPHVmVhYwiLtKkKk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GbeIR21Tn9SypZi.exepid process 4012 GbeIR21Tn9SypZi.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
GbeIR21Tn9SypZi.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\epknjhfkcknpbclimgjlhecpngdkacjk\2.0\manifest.json GbeIR21Tn9SypZi.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\epknjhfkcknpbclimgjlhecpngdkacjk\2.0\manifest.json GbeIR21Tn9SypZi.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\epknjhfkcknpbclimgjlhecpngdkacjk\2.0\manifest.json GbeIR21Tn9SypZi.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\epknjhfkcknpbclimgjlhecpngdkacjk\2.0\manifest.json GbeIR21Tn9SypZi.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\epknjhfkcknpbclimgjlhecpngdkacjk\2.0\manifest.json GbeIR21Tn9SypZi.exe -
Drops file in System32 directory 4 IoCs
Processes:
GbeIR21Tn9SypZi.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy GbeIR21Tn9SypZi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini GbeIR21Tn9SypZi.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol GbeIR21Tn9SypZi.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI GbeIR21Tn9SypZi.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
GbeIR21Tn9SypZi.exepid process 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe 4012 GbeIR21Tn9SypZi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
GbeIR21Tn9SypZi.exedescription pid process Token: SeDebugPrivilege 4012 GbeIR21Tn9SypZi.exe Token: SeDebugPrivilege 4012 GbeIR21Tn9SypZi.exe Token: SeDebugPrivilege 4012 GbeIR21Tn9SypZi.exe Token: SeDebugPrivilege 4012 GbeIR21Tn9SypZi.exe Token: SeDebugPrivilege 4012 GbeIR21Tn9SypZi.exe Token: SeDebugPrivilege 4012 GbeIR21Tn9SypZi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exedescription pid process target process PID 2220 wrote to memory of 4012 2220 a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe GbeIR21Tn9SypZi.exe PID 2220 wrote to memory of 4012 2220 a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe GbeIR21Tn9SypZi.exe PID 2220 wrote to memory of 4012 2220 a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe GbeIR21Tn9SypZi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe"C:\Users\Admin\AppData\Local\Temp\a8e79fcbc53422a72841d43f8f98769f3bfba98cc048750727357396a04190d8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\GbeIR21Tn9SypZi.exe.\GbeIR21Tn9SypZi.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\[email protected]\chrome.manifestFilesize
35B
MD54e80fada39e1a0d3556eadf660d81e2d
SHA1fae0da908192f3b7a6c392de52b25e0da04c2d26
SHA256eba2a80d07b735cc83db6ee499e6ca92faa9a87ebe1dbec509504d7c4e48f8e9
SHA512610c72d579ecef2f060e5cc295859f93657afe416f63e7da53b4ef4a47124eac152243b2d2bb7d54f7a8f880ebb363e589ad309af4f4d2ec0a85499907ad2193
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\[email protected]\content\bg.jsFilesize
9KB
MD505c022dd0144977ae65d5e62bffa01bd
SHA1c2688251c46919786f1e1c4c296ce0ee58e2fea1
SHA256f980b151d86254fe4194b9ec42f19319843962e2e6297d3e287de212db4aa35d
SHA5127f36d0bba212088d0a400e9b502a460fa6b62276f57cd6d02480a518c87f19cd6407a4a2729551ccaacbf86402b62330cfafdefd966460c932327a828f1a593e
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\[email protected]\install.rdfFilesize
596B
MD582106d283f3038de87cc989999d941fa
SHA16fb99736bd720474ed84b2d7f00a9d65f758e2ed
SHA256e9f6216300134dcfbae265c7274c4dd59e07d9608a9a7a612f145875cb7fb4db
SHA512e46191f7fe61a9c4be90d7fbb840da16723d5d73c88ee88f2c2797b88b252b39a37242e79231428f2c82e7f58cb4943c909f5324c68ede63bb2c40145558278c
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\GbeIR21Tn9SypZi.datFilesize
1KB
MD5f13980a84a6450bd3c1e28371bc8e632
SHA1b1de3684d2d9776c410a1c47265487d6efe7b48f
SHA2564d0dbd641cd5a83168570389060a7d0509b4c6fe9387f6cee3cb9824ebafd8f8
SHA5127b259cc8fa67a7c6b68d39f952e09fef022d93f271205608d2f4bf31406406a655e4d12bffc80e1948dc89a6dde285809b8793ebf6d4d005fafaefd403fe8157
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\GbeIR21Tn9SypZi.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\GbeIR21Tn9SypZi.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\epknjhfkcknpbclimgjlhecpngdkacjk\aY.jsFilesize
6KB
MD52e3ce4249ea53c4e084cd4ad95766a43
SHA1ca9778969fb021fe85031b31875b88fc988e8158
SHA256937f0d24797d28c43cc95ab75e8667c03929a80eea077a1e7356b11adafe6010
SHA51299b87a1df2a5a964e208183433b3129809ca83de88a4da228b1fd3f766c7e65d5c7b3e317749f14115bcb55b45e2ecaa6541bce037bdbad4cb3371151cb2c028
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\epknjhfkcknpbclimgjlhecpngdkacjk\background.htmlFilesize
139B
MD5bf0eeae9c38255a00aa837ea7c2f02a7
SHA1a6874cc2c5e172d620c86a2794a664ae91f7b4bf
SHA25627b1526d3196bc863f848a8f2702f1fc8ec305c062f1d22aca6239d8fe653098
SHA51261337b6d7694099c21919ebb048be463e731fc1b9503567c5795573cb9f997bc1fb03d4db26c2bfd78aa2143161fde1f6b0c3e269d50b831ec939ab9d674e8ad
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\epknjhfkcknpbclimgjlhecpngdkacjk\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\epknjhfkcknpbclimgjlhecpngdkacjk\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS80FC.tmp\epknjhfkcknpbclimgjlhecpngdkacjk\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4012-132-0x0000000000000000-mapping.dmp