a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe
Size

920KB
MD5

3c66daf0bfcfad3b7cb998508a338dfd
SHA1

c9147b2d66a7e3cb99e6d5684a3e6115b604db04
SHA256

a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61
SHA512

a5f534aaa8e2cd69fb855b4b81adf3f43cdd9f8e478b960d35cbebbbcb7eec7a64435b23ce8f4e2ba99a3ffff762e8938329280c3ac1253dcc1555aa84fa6e99
SSDEEP

24576:h1OYdaOEMtdHAqcdDVhYwiei7+EpFAh/kKr:h1OsJPHVmVhYwiLtKkKr

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

S5NWAgyuGolHOqn.exe

pid process

2348 S5NWAgyuGolHOqn.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

S5NWAgyuGolHOqn.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\boleihacleocaodhklmhobikgjbmbkmd\2.0\manifest.json	S5NWAgyuGolHOqn.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\boleihacleocaodhklmhobikgjbmbkmd\2.0\manifest.json	S5NWAgyuGolHOqn.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\boleihacleocaodhklmhobikgjbmbkmd\2.0\manifest.json	S5NWAgyuGolHOqn.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\boleihacleocaodhklmhobikgjbmbkmd\2.0\manifest.json	S5NWAgyuGolHOqn.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\boleihacleocaodhklmhobikgjbmbkmd\2.0\manifest.json	S5NWAgyuGolHOqn.exe

Drops file in System32 directory 4 IoCs

Processes:

S5NWAgyuGolHOqn.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	S5NWAgyuGolHOqn.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	S5NWAgyuGolHOqn.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	S5NWAgyuGolHOqn.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	S5NWAgyuGolHOqn.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

S5NWAgyuGolHOqn.exe

pid	process
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe
2348	S5NWAgyuGolHOqn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

S5NWAgyuGolHOqn.exe

description	pid	process
Token: SeDebugPrivilege	2348	S5NWAgyuGolHOqn.exe
Token: SeDebugPrivilege	2348	S5NWAgyuGolHOqn.exe
Token: SeDebugPrivilege	2348	S5NWAgyuGolHOqn.exe
Token: SeDebugPrivilege	2348	S5NWAgyuGolHOqn.exe
Token: SeDebugPrivilege	2348	S5NWAgyuGolHOqn.exe
Token: SeDebugPrivilege	2348	S5NWAgyuGolHOqn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe

description	pid	process	target process
PID 4016 wrote to memory of 2348	4016	a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe	S5NWAgyuGolHOqn.exe
PID 4016 wrote to memory of 2348	4016	a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe	S5NWAgyuGolHOqn.exe
PID 4016 wrote to memory of 2348	4016	a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe	S5NWAgyuGolHOqn.exe

C:\Users\Admin\AppData\Local\Temp\a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe
"C:\Users\Admin\AppData\Local\Temp\a8a965fe3adc53971f738fcdd2a0dd0826676320d5d862723f060c1703d02d61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\S5NWAgyuGolHOqn.exe
.\S5NWAgyuGolHOqn.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
2f165edcf2017a9ad04a813c4d416700

SHA1
2dd0adad66c4fddce7f59e9c541d8f9578ee38c6

SHA256
74d6b4bd4f97746fecd9c7af752eab0b06ba9c132f487572aadf36951071c095

SHA512
f6743d6f12ddb653a8132129f1aaa394bf0100912a31452445657f1817abe7e0dc0d776d178ee8e5f8c9b9830fea9021bd086205f486a7e631f08ec5a9064ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
77b852ea7ae90561145018e35ed7856e

SHA1
4d4a36352c9e3a81e1a661199ff79abedbe43ff7

SHA256
8ad2561cea9b7d94aaa419213446529674217afcc2bd578fec6eb4359d0a105d

SHA512
0fb6d7ee7479b5d82063e7b86228af71882d0b2e1c85586fb5a7907f3ce3e7e9806081e508257860359c854f711f7f749fe8a449a3bc00fff0727660f6806ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\[email protected]\install.rdf
Filesize
591B

MD5
bc9c953595aea171a00a8e539d81f708

SHA1
9a5e6c7f14a35c04643eb9c2a03b80b0a711550e

SHA256
17d42f38630dd39945f6ae2a1e6eff9756e7f7691ba1af206e70fc86efe3de72

SHA512
7a02cd9b2c96ec9a0c55952bc7f4aa319fa54c99b5f9e3b468fc823ca30b825e13f447f5e7539b2ea99f360118179324373c3d3b99ed3a81ef054cf4d79907ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\S5NWAgyuGolHOqn.dat
Filesize
1KB

MD5
94bdddfbeb30d0f54ad22294b2afbc07

SHA1
db3d25a5db8ebc82f5bf60cf71025863f0a93c9a

SHA256
df8304fbc0e3262178d72fc7487460377bd90b11d21bb5839062690c76ac74d0

SHA512
2342481d0a18de8bf71f433b92ee9ce6c3f1d3c954a4713ddd9b07b1fd779d3142ec9296b79bf7260740440e3305a0aed55e2bc32151c48142ad34f2fd92f665

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\S5NWAgyuGolHOqn.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\S5NWAgyuGolHOqn.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\boleihacleocaodhklmhobikgjbmbkmd\background.html
Filesize
138B

MD5
b566a7b485f09aa71608552679b7bdfb

SHA1
fcdc8805206820a2cd7d43d31b104088de594f4b

SHA256
fbcf0e9cbb35c1133503b638b1d971099cd542daee708dc4ccc13908fea9f5f6

SHA512
5a27fd0c21a282cd034ce7ec848966259f5e5d7ba077404399bb7ff7f2d189354e3c25c5c4eb6f5e9f5a9b16bb4a139db375cd9d21de68e9e2cbbd104844b333

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\boleihacleocaodhklmhobikgjbmbkmd\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\boleihacleocaodhklmhobikgjbmbkmd\k.js
Filesize
6KB

MD5
f69cd3d6b6e3a2d152bb1e475e3e9ab4

SHA1
d152ce4523e6e645cedb04c86ac681c69b622dab

SHA256
6b7b5b3c44c29b5ef30db6716bd7801d51009d288487a0ca41954d474e76f978

SHA512
90e86bf40d4ba2ddbfc56ac536d717754d734056aaaaa609721b2dfbf1dc60e03968f43a684d0882224caaf608ceca78522b12652f7f7b1d15c3600cb9bdf45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\boleihacleocaodhklmhobikgjbmbkmd\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD21A.tmp\boleihacleocaodhklmhobikgjbmbkmd\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
memory/2348-132-0x0000000000000000-mapping.dmp

Download