Analysis
-
max time kernel
192s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:06
Static task
static1
Behavioral task
behavioral1
Sample
a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe
Resource
win7-20221111-en
General
-
Target
a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe
-
Size
920KB
-
MD5
51912b798cd8ae90f6e7f9cb7c447180
-
SHA1
de3b25e6e2a79690bf35f15459ef869bee5d2137
-
SHA256
a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76
-
SHA512
dda2d482a24513bd82454dcbfe788aacc0992e36065fb2ad6b1bcdb46e2ffc7c07924a1a16573f29fafc8d26d730b97a89590fb33d6eda5d7a695579bc1ce9b4
-
SSDEEP
24576:h1OYdaOeMtdHAqcdDVhYwiei7+EpFAh/kKQ:h1Os7PHVmVhYwiLtKkKQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
vpIIWEPZ5OaLSnr.exepid process 3580 vpIIWEPZ5OaLSnr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
vpIIWEPZ5OaLSnr.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipginbemenfeoggdcalaejicmphdhkod\2.0\manifest.json vpIIWEPZ5OaLSnr.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipginbemenfeoggdcalaejicmphdhkod\2.0\manifest.json vpIIWEPZ5OaLSnr.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipginbemenfeoggdcalaejicmphdhkod\2.0\manifest.json vpIIWEPZ5OaLSnr.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipginbemenfeoggdcalaejicmphdhkod\2.0\manifest.json vpIIWEPZ5OaLSnr.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipginbemenfeoggdcalaejicmphdhkod\2.0\manifest.json vpIIWEPZ5OaLSnr.exe -
Drops file in System32 directory 4 IoCs
Processes:
vpIIWEPZ5OaLSnr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini vpIIWEPZ5OaLSnr.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol vpIIWEPZ5OaLSnr.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI vpIIWEPZ5OaLSnr.exe File opened for modification C:\Windows\System32\GroupPolicy vpIIWEPZ5OaLSnr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
vpIIWEPZ5OaLSnr.exepid process 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe 3580 vpIIWEPZ5OaLSnr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vpIIWEPZ5OaLSnr.exedescription pid process Token: SeDebugPrivilege 3580 vpIIWEPZ5OaLSnr.exe Token: SeDebugPrivilege 3580 vpIIWEPZ5OaLSnr.exe Token: SeDebugPrivilege 3580 vpIIWEPZ5OaLSnr.exe Token: SeDebugPrivilege 3580 vpIIWEPZ5OaLSnr.exe Token: SeDebugPrivilege 3580 vpIIWEPZ5OaLSnr.exe Token: SeDebugPrivilege 3580 vpIIWEPZ5OaLSnr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exedescription pid process target process PID 3388 wrote to memory of 3580 3388 a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe vpIIWEPZ5OaLSnr.exe PID 3388 wrote to memory of 3580 3388 a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe vpIIWEPZ5OaLSnr.exe PID 3388 wrote to memory of 3580 3388 a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe vpIIWEPZ5OaLSnr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe"C:\Users\Admin\AppData\Local\Temp\a83ee09f9b54802b2b90356eecc8543ec5871b201d85e749c65f40237f076c76.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\vpIIWEPZ5OaLSnr.exe.\vpIIWEPZ5OaLSnr.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\[email protected]\chrome.manifestFilesize
35B
MD5fd6f151edb31f92fe0d6e141faff31e1
SHA196d96b182dcbf29a53cf1510bdd2ebf0153e4d33
SHA25673dd8cbb4439eca1549afeacd6e0577102dbbc3dc97bd7e0d257eba5f09d448c
SHA512bc6fee89db5a05c1774560a022061417d4a7567c58f58c72965e500a85703f2db4dcba15675b6446d64d013a2ff81a311011c56fbe6f2b2e79d6985152112440
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5f04be1a5d96cfc46f903755808238525
SHA1aab1614251548ba672e3f0fefb6659d1e217bfb0
SHA256af5f86b7a55a97b86e51b14446051a9aba257f486dcca5dc77adbc00a968d065
SHA512b020667535bbd75fd3d8bb6bf0412ef9ffb6842847b1e3b95a8ecec32571cb7f4898e79acd686b88a6e58260ec05a4e3f3938aea5cfd2b7ca2b1d271fbf209f4
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\[email protected]\install.rdfFilesize
593B
MD566632ed67c6082d7a1375f442b8e8165
SHA18562afed4d8e6575558025bbc21cb62a0bea17a9
SHA256d12cba3f8b10bbe81f2acc02d184f7251cef9a3dd34b705198b8fada415f83e3
SHA5122dcc538efa48a681b8c68eee722c86caf77beeab45d58782d6919dda0c5cfe3bdf90918940de7df21effd91338ff15b9b344f36c79b20a8c65f233b99b144469
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\ipginbemenfeoggdcalaejicmphdhkod\background.htmlFilesize
143B
MD5c9fddb0095abb3a7f71562834f563d8b
SHA103ca04b3fd8eb76264a6998eefcc495d94c913cc
SHA256e35b8cecaa1aa567da7ea57fa6f2721d793d88f42a206e1f104db81bda1243d8
SHA512f5961f8a56900ee64558c48b808cebf876d127b74429e4e6f501c7d06d2c5be8fae2e756d07071be7fde2ddb68fb7a1d03179c5237f6b7030cb85fce3a933147
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\ipginbemenfeoggdcalaejicmphdhkod\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\ipginbemenfeoggdcalaejicmphdhkod\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\ipginbemenfeoggdcalaejicmphdhkod\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\ipginbemenfeoggdcalaejicmphdhkod\tDb3qV.jsFilesize
6KB
MD5eba5cbd03d8f2c3f44c9d8fe22bf8daa
SHA1790af7f57691ff4be3ccc3c45932e5dcd5fb5d0b
SHA256a30ea9fa97b647a242cadfdc18c96521a6c2949c3b8f7a052062b3c76237a205
SHA5124004edaed851b23c06454e5bbfd6f923c5af212b93adb222d94bb213747f7333dabe8c18fc07680cfda2a47034c4c4637d413f41fa3ff5205a466b66c9239f16
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\vpIIWEPZ5OaLSnr.datFilesize
1KB
MD5848c1f1462507e3c4cb8a4be595da574
SHA1abe75377d22a9d84e470e2a39b5bddb431b8df91
SHA2562fdf1b0e95c1c3efd507911eda9fcea0edbf503eae1221c1bcd318cf64c8f923
SHA5125f563963bf5bd66a9f37c7e40ffd8f21704e913cafd609c2bbac16b8a0be92a01b45b2f45fbf767b96c3ba5dc3d0e66b9f965c4a551d8f849f0f8e05ef246935
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\vpIIWEPZ5OaLSnr.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS7109.tmp\vpIIWEPZ5OaLSnr.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/3580-132-0x0000000000000000-mapping.dmp