a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20

Analysis

max time kernel
127s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe
Size

920KB
MD5

838d49ecd82c23f37b71cd21ff710524
SHA1

d4cb6cd2c21ed7a9da9fcdb01d6beffe3fc986c4
SHA256

a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20
SHA512

85ac802cc0b1f090bc5382abbddbc63bbfed303634aa8d15c5cb2a5ee0575de0e57501244892640fb62f133b0a87ababad793d757dc63589548a9deb445af70e
SSDEEP

24576:h1OYdaOnMtdHAqcdDVhYwiei7+EpFAh/kKk:h1OsSPHVmVhYwiLtKkKk

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

qo4oG6Qf9rRkuqg.exe

pid process

4884 qo4oG6Qf9rRkuqg.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

qo4oG6Qf9rRkuqg.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\djmcobekhpikfgaanejnffhcejfklaag\2.0\manifest.json	qo4oG6Qf9rRkuqg.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\djmcobekhpikfgaanejnffhcejfklaag\2.0\manifest.json	qo4oG6Qf9rRkuqg.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\djmcobekhpikfgaanejnffhcejfklaag\2.0\manifest.json	qo4oG6Qf9rRkuqg.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\djmcobekhpikfgaanejnffhcejfklaag\2.0\manifest.json	qo4oG6Qf9rRkuqg.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\djmcobekhpikfgaanejnffhcejfklaag\2.0\manifest.json	qo4oG6Qf9rRkuqg.exe

Drops file in System32 directory 4 IoCs

Processes:

qo4oG6Qf9rRkuqg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	qo4oG6Qf9rRkuqg.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	qo4oG6Qf9rRkuqg.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	qo4oG6Qf9rRkuqg.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	qo4oG6Qf9rRkuqg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

qo4oG6Qf9rRkuqg.exe

pid	process
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe
4884	qo4oG6Qf9rRkuqg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

qo4oG6Qf9rRkuqg.exe

description	pid	process
Token: SeDebugPrivilege	4884	qo4oG6Qf9rRkuqg.exe
Token: SeDebugPrivilege	4884	qo4oG6Qf9rRkuqg.exe
Token: SeDebugPrivilege	4884	qo4oG6Qf9rRkuqg.exe
Token: SeDebugPrivilege	4884	qo4oG6Qf9rRkuqg.exe
Token: SeDebugPrivilege	4884	qo4oG6Qf9rRkuqg.exe
Token: SeDebugPrivilege	4884	qo4oG6Qf9rRkuqg.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe

description	pid	process	target process
PID 3548 wrote to memory of 4884	3548	a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe	qo4oG6Qf9rRkuqg.exe
PID 3548 wrote to memory of 4884	3548	a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe	qo4oG6Qf9rRkuqg.exe
PID 3548 wrote to memory of 4884	3548	a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe	qo4oG6Qf9rRkuqg.exe

C:\Users\Admin\AppData\Local\Temp\a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe
"C:\Users\Admin\AppData\Local\Temp\a8ad6df16e1e2f94557973f4b01c6079031bd1a767225e7fa0dc012fbe95fc20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548

C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\qo4oG6Qf9rRkuqg.exe
.\qo4oG6Qf9rRkuqg.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\djmcobekhpikfgaanejnffhcejfklaag\Is.js
Filesize
6KB

MD5
5ea6dc649fed587d12af191b6bddf325

SHA1
62dd54e54520d0a13ddf3f6799ae507310be95bf

SHA256
ce0eb92d77a0867716e4d74c10180d63814686086a1125e8c136f8cff0177f77

SHA512
f5b04e7336f1bf45445c9e74c0e92312eeee630f21b99a94232ac483c98ebb5d250d27f424e4e40cd91b415bda59069be603b379c3ed0f5579bf5db6ef0fa5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\djmcobekhpikfgaanejnffhcejfklaag\background.html
Filesize
139B

MD5
6a146681780add68528cde49bd24ada5

SHA1
cea64bca5d55f37eace5aba174b0ee1a1fb0b53e

SHA256
29152d80c51e10f6402338781c814f98c5a20b85354e541021de38d553a82f0f

SHA512
2bf5b22097e73340bcda8e779f2c92e35a00085d10ab7b1dbf1fa32a29cb8ebd95517513a5dfd73957abd277cbc07b9a5188a202958069f7b1d24ac3e900b4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\djmcobekhpikfgaanejnffhcejfklaag\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\djmcobekhpikfgaanejnffhcejfklaag\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\djmcobekhpikfgaanejnffhcejfklaag\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
65699165b75720e2f50df316805dfefe

SHA1
b69a43ebfba9ebae8a2697a15ca001794a209f72

SHA256
ca4c88c2c9c18c339de7fbf3283a1c385d3fa66a61603c8d4be1a591c88367e8

SHA512
9200ca5af7a80bc0ccd5f02fe89de81e759376adffae968418b34c00f70516962785270f46b01ecb3588156860c2fc88970a19fab6085d21b66edcb2e0046735

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
80274892e9bf14dca9ff0a0a1f298519

SHA1
e12ae66f1ecd491fc62ad970408128e660ead780

SHA256
50ae05c4a03a5a25b6959cd9920475b1e82ba2ed96b509ec77291ef884180d11

SHA512
2403057b76ae267805c93d775d3aae04f9ce35ae2140b746c7b3a7504cbcedf4f22b92df382864e44cb0c54dead05362337f4188b29c20039b1dfd7978c29093

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\[email protected]\install.rdf
Filesize
599B

MD5
541e4a9c05dadede4f7e5334c359c567

SHA1
9fef9716f978b5e0a469beda17e39e946fe8fee2

SHA256
27e4a22584e360379cd33ae24066bbce41826765732a93266b05d3ceb19b3087

SHA512
e9aaf801e5acbe5584a4d6352243a4b30940bf57764d78f27e7885472138ca076303650e29ee7aef9f63e36618c69a7c712411fcd06a2cbb2e5b1aeb944bd25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\qo4oG6Qf9rRkuqg.dat
Filesize
1KB

MD5
7366a1cdfa68b31a56024d8293b90c0c

SHA1
8fc1fe848bdba04e986ba4f11c032e7fc63af1c5

SHA256
863a3f3ca2a7373cd8648fbc7381c36f71951a7506ec41ce89cc3a86192bcb99

SHA512
61f89bb7f60feaa59d5c364314876661eee4a56f81ca20bcb66726fb8414feced0e40bd9fb84990e44430ce0a3ab791f50db86a463f05c3059f68bf02948ae86

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\qo4oG6Qf9rRkuqg.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92AF.tmp\qo4oG6Qf9rRkuqg.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
memory/4884-132-0x0000000000000000-mapping.dmp

Download