a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe
Size

920KB
MD5

af3e99ce5957eb198424bfc0e5d7459d
SHA1

e39176f7eb9059a4952c98e0bfdfb9c35bf171a1
SHA256

a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907
SHA512

bc1a36ada5a859caf82194615a9bb01f9b5aaa01380ab7eb9bdfd932c2d29fe00a6edd4e7cbc0e1f5f9d5213b10b90b2c438f6c4ee8429161fc668e963576a4a
SSDEEP

24576:h1OYdaOfMtdHAqcdDVhYwiei7+EpFAh/kKg:h1OsGPHVmVhYwiLtKkKg

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

9dOhTl6Xx5tFwfH.exe

pid process

860 9dOhTl6Xx5tFwfH.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

9dOhTl6Xx5tFwfH.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcgenjlgnegofjlcgahoenflgfjhelpf\1.3\manifest.json	9dOhTl6Xx5tFwfH.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcgenjlgnegofjlcgahoenflgfjhelpf\1.3\manifest.json	9dOhTl6Xx5tFwfH.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcgenjlgnegofjlcgahoenflgfjhelpf\1.3\manifest.json	9dOhTl6Xx5tFwfH.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcgenjlgnegofjlcgahoenflgfjhelpf\1.3\manifest.json	9dOhTl6Xx5tFwfH.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcgenjlgnegofjlcgahoenflgfjhelpf\1.3\manifest.json	9dOhTl6Xx5tFwfH.exe

Drops file in System32 directory 4 IoCs

Processes:

9dOhTl6Xx5tFwfH.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	9dOhTl6Xx5tFwfH.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	9dOhTl6Xx5tFwfH.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	9dOhTl6Xx5tFwfH.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	9dOhTl6Xx5tFwfH.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

9dOhTl6Xx5tFwfH.exe

pid	process
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe
860	9dOhTl6Xx5tFwfH.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe

description	pid	process	target process
PID 2412 wrote to memory of 860	2412	a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe	9dOhTl6Xx5tFwfH.exe
PID 2412 wrote to memory of 860	2412	a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe	9dOhTl6Xx5tFwfH.exe
PID 2412 wrote to memory of 860	2412	a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe	9dOhTl6Xx5tFwfH.exe

C:\Users\Admin\AppData\Local\Temp\a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe
"C:\Users\Admin\AppData\Local\Temp\a78c046c923906a8dfdc3df0efc306d795ea7996a62e339c4fb82f8ec4302907.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\9dOhTl6Xx5tFwfH.exe
.\9dOhTl6Xx5tFwfH.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\9dOhTl6Xx5tFwfH.dat
Filesize
1KB

MD5
9488f8a11c036cc7bfac951ce0b4ace8

SHA1
bbe19751483dd080ae70cb014e624d6bb7035d69

SHA256
21536564693e9734c9ad421e281a713e5da1bcb5c845e941c88863abd931f983

SHA512
9036ce6c0bedc6eca812e5fcb5309cead0f99be3e70f1631ca8dbfce5f251819cad429128c121040106fefe7208cf80c52b94bed2c6b03947eb9d80403e823ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\9dOhTl6Xx5tFwfH.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\9dOhTl6Xx5tFwfH.exe
Filesize
760KB

MD5
dcd148f6f3af3e3b0935c4fcc9f41811

SHA1
ee9bdbc7c568c7832d90b85921ab20030b6734cd

SHA256
f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4

SHA512
34be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\dcgenjlgnegofjlcgahoenflgfjhelpf\background.html
Filesize
141B

MD5
cb622b96652a8a26d7c3140f33bd12c2

SHA1
f79dc915900113c9eef0a39af472bc762dc69d41

SHA256
eed87d031aed245e7434fa517ab4294aa2544ae68e0eca01b2a6e54c31364e77

SHA512
8ba1fd3c2ada2eefcd7305cd035ac1d4a00ee9179f60484d067245ab66456623b45ae90166a8379759d776c2ff63a08c8921fdb3e7533d2e743e2012ba238059

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\dcgenjlgnegofjlcgahoenflgfjhelpf\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\dcgenjlgnegofjlcgahoenflgfjhelpf\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\dcgenjlgnegofjlcgahoenflgfjhelpf\manifest.json
Filesize
498B

MD5
664e2884e17f23553a19eee317642194

SHA1
a28ccc088d6b6692646150f3e8f111e568723fb4

SHA256
ee4ef853224cde2aa7e54351c02bc811af939202b82e19cbd1cc011fc3565191

SHA512
b2cef8c4dfb6a0648f21c53393b982c9171d8a0344a94970c13866ebd2870de2cd99dab5984000b10802c54a748230104c7997c3d2cd3ac5e97c9355a4cb7ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\dcgenjlgnegofjlcgahoenflgfjhelpf\yBZU.js
Filesize
6KB

MD5
aef460da9bb6584581ab1adb3337e208

SHA1
6cbec498d39e6a3ab9ab791f3fac756e93a53441

SHA256
668b8285c400dc0dbadb704523d77ae8676a2f04b648209c171c5f77b1d47004

SHA512
66915a37a302790e411c86913307d4682b6d81cd0c65cfd6a56353358cb9f1e070b5179d76bfb0daf3f6d63773133a645f4903deff98a361d098dfa7f594894c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
a7a5848bfaa1dc7d70b7d1574889428c

SHA1
3ade8c6eb014898e68aa7a73d37da6c2ebdffc23

SHA256
bce03fa22df14ba4719f0d1f56f84e204bf8444dd54c2d133e30e05c0d7f591c

SHA512
82ec116baa5a81745880d011289f9e902e0b53a1f35cbf56f749f1cfa68530a8b07cf50540269dd4caa9a5f8eb2066396df511e43dd454037b73826e4d16b67f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
825c2d679238afcc116a33498e5638ee

SHA1
5a0f1d175285162c17ffa5da41bd4813ebb9edf8

SHA256
2d74e352282a75cae2ae337316ef3b372b35daa992d43e6d54c34bc9d07fd63b

SHA512
35dfe1aa36a422d9b6e7e4b970384bcb59c06b32c6e3485873980c491420aac9aa00b911d59b1d023467e40a3e40ba325ef54ae21361906d92f7f9e13ae11421

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS84D5.tmp\[email protected]\install.rdf
Filesize
596B

MD5
e456548654db7de4a1c1c83fdbfb9588

SHA1
af7b685b6a12f30c89868162cfe74b2f8de7f5b9

SHA256
4c7fae360d6e535afa075c6a5aedb7b01d80af16bc2a4bcc6b32c2b8f1aacd91

SHA512
ed94602fd6dc1fab8f7309f930d45a799ff9d861f26920f4ccbcf234abec1120015711f3d470996866bea96844c3d3a356bfb313acbe0b33c37d48c116af404c

Download Submit
memory/860-132-0x0000000000000000-mapping.dmp

Download