Analysis
-
max time kernel
229s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe
Resource
win7-20221111-en
General
-
Target
843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe
-
Size
2.1MB
-
MD5
c7e133b809037dd474bab282e9ee0baf
-
SHA1
4039cd2d7590a2b8c784eeaed4ab1aa2b20faca4
-
SHA256
843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae
-
SHA512
b176eaa212524d9cbd5194aec98da0adfca66a968a5e9ad068877608b62348f15ea7ed6af9aa734d2b0cfd0338deada7570e7aa9f7b39f6bae887f3f0eaadecf
-
SSDEEP
49152:h1OsIhvaZG1MVEtzijkTvu2x/uw4B8FHFF6U:h1OHvaxMziy3V
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1696 Ga6xbO5i397d9Nu.exe -
Loads dropped DLL 4 IoCs
pid Process 1352 843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe 1696 Ga6xbO5i397d9Nu.exe 1668 regsvr32.exe 364 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\1.3\manifest.json Ga6xbO5i397d9Nu.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\1.3\manifest.json Ga6xbO5i397d9Nu.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\1.3\manifest.json Ga6xbO5i397d9Nu.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} Ga6xbO5i397d9Nu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ Ga6xbO5i397d9Nu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects Ga6xbO5i397d9Nu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} Ga6xbO5i397d9Nu.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} Ga6xbO5i397d9Nu.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.dll Ga6xbO5i397d9Nu.exe File created C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.tlb Ga6xbO5i397d9Nu.exe File opened for modification C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.tlb Ga6xbO5i397d9Nu.exe File created C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.dat Ga6xbO5i397d9Nu.exe File opened for modification C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.dat Ga6xbO5i397d9Nu.exe File created C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll Ga6xbO5i397d9Nu.exe File opened for modification C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll Ga6xbO5i397d9Nu.exe File created C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.dll Ga6xbO5i397d9Nu.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1352 wrote to memory of 1696 1352 843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe 28 PID 1352 wrote to memory of 1696 1352 843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe 28 PID 1352 wrote to memory of 1696 1352 843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe 28 PID 1352 wrote to memory of 1696 1352 843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe 28 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1696 wrote to memory of 1668 1696 Ga6xbO5i397d9Nu.exe 29 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30 PID 1668 wrote to memory of 364 1668 regsvr32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe"C:\Users\Admin\AppData\Local\Temp\843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\Ga6xbO5i397d9Nu.exe.\Ga6xbO5i397d9Nu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:364
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD550e5b5013989b82868a471aee708b531
SHA1406ba1cd9dbb609b6132832bca9735a7fd8d550e
SHA256c11d4288f3d9693e581d7dec5e813d7d230db3199ba45ec3b305c528ed7b0ad9
SHA512d3daec154c35242f9bb9dd802eaff9b690dd8fded1e297b660cdfec5c2bf09a33123377a1afc2117827360ca6cd5ad9457ebf3133a1a076754fa1357fc90cb5f
-
Filesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
Filesize
6KB
MD550e5b5013989b82868a471aee708b531
SHA1406ba1cd9dbb609b6132832bca9735a7fd8d550e
SHA256c11d4288f3d9693e581d7dec5e813d7d230db3199ba45ec3b305c528ed7b0ad9
SHA512d3daec154c35242f9bb9dd802eaff9b690dd8fded1e297b660cdfec5c2bf09a33123377a1afc2117827360ca6cd5ad9457ebf3133a1a076754fa1357fc90cb5f
-
Filesize
634KB
MD5bd1503d4eaae5e7f2a8cdbd9a88ec02a
SHA1730280a7839bb46bdeeaa47797d926f8d57e1da1
SHA256724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4
SHA5120dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b
-
Filesize
634KB
MD5bd1503d4eaae5e7f2a8cdbd9a88ec02a
SHA1730280a7839bb46bdeeaa47797d926f8d57e1da1
SHA256724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4
SHA5120dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b
-
C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\chrome.manifest
Filesize35B
MD5050cc2c401bf190a7028d106a514de3b
SHA1fc4cf2a4a8e80a5162234509bafb52f476603378
SHA256ab468540403542ba4bd7a94319b07aeaddeaa65512d3992f11b2f361623f5d7a
SHA512bf0ca3d6078b2a6daad23736e9eeb873b1269fed50d511f77574aa41aa5a521e7db40a01988d63d97e579f4c44f94e2047413894ebfb37ae7217987eadc1de1e
-
C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\content\bg.js
Filesize7KB
MD54756cf768398cd97798aba79c449a3bb
SHA181b50e0256843eca3d64219ea12ffb409c338131
SHA25697afc49147aefb90651cba1cd0dfff1da7cf881ba2e0f442e785e8c07e05ec12
SHA51219f3d795234a93270032dc0c0df47912b14adab67522344282128d3fdaca6a213f555039ffc401083cd649365299fd8fca102f1cb488fd68b527dea1c16e2c7c
-
C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\install.rdf
Filesize592B
MD532dae9c1a7c79b2a73ccf7f139845caf
SHA1b5a34844efd8891ed0210ed66749cf48a290f24b
SHA2561c9b7f47882c0e3dcc74a09a5b2484a8b6c832598443647cef96bb1b85417760
SHA512332cce7a9b48cea6f55705848f49348c47dc3148e3180e15fd86af8120e3887aed3a679757cc54092487bb805dd81161b90359b26529837d42cb5b26bf4a0ff2
-
Filesize
618KB
MD5f180a95d8673cd01ce4af0ff678fa099
SHA18592fe958436e14ef9ace437ac4445ecca22e35e
SHA256d40aa49822621713e0f79f6c9a187468251fc22559cb1bbd6b5f71a94819eeb7
SHA5123dda5f3133df4c00c03d8b3fb539b37e2e6b26d0384d3674cefa9595136f9eaa4b9d21c0e806a9ec3cfadfb782a30e344145abbf87bca813de056f84c6fb13c9
-
Filesize
3KB
MD58af6f42a5b16ced04702514d47052053
SHA1f06e43c9710e27b38063652217874f6fc8515ea0
SHA2560fc752f18e2f21a6d0b45fb9769deefe70d4690e72225037a37d1dc0553ae8ed
SHA5122d1fedf6693f0347d9265436fbc17515fa9a904db54170181ca7a6d5c64a4928494a20a1eb489d646602ed2769e570bfb5835bffd241a53a8fe64d5767b9234b
-
Filesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
Filesize
138B
MD5af5168de756b9a53a8b970b0e95139a6
SHA10fe25eb8bb6919808de08d59dd3a09a2cdaba3f3
SHA2564b937c436472ad4670a555265f93f078bcf4ea5faefccf7ff5c137a482731b69
SHA5128d1597aae1e07a990dfe000466e4609ff582a095094df0e18e5683a8761906aca3d0b905a1f65f38212e21bbb5b0621f130fa66d2233e197878c2b9365c75c64
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
499B
MD59ff3b6507d9edff1aa02443f76234ce4
SHA1f88f4520c20d853858c09b5cdcc2720ebfa715b6
SHA256e09b67786820607df16b9e864f3b2a23ff5908ca3b13b2f14f6cdca052f46efd
SHA5129e84a3c3cbcb53a7a987d9e34a867caa1ec680ee29d37ad233a84ee67950fc1325c98cb6820194829da3aadfc73aec618e29f01b687ced36899c4bd2eb51edfd
-
Filesize
5KB
MD5dd3befbc50bd5d37d87f0c933ae9cb7b
SHA1b15937c5d2dccce0513e7c36d884f3d2324c7449
SHA2566bd2d3b1cddd4c066d40d049f4610456c95acc41ecfb7b2631bb1f1d21e670a4
SHA51295c1177c5ea258fa5fbb5c72400f4d6cd72589ad7589c63530905fd80dad6bc07433e80f41e3d46b4687c3dd7f853ab6cfbd6da0d0781dd68e7a670aeaf05303
-
Filesize
618KB
MD5f180a95d8673cd01ce4af0ff678fa099
SHA18592fe958436e14ef9ace437ac4445ecca22e35e
SHA256d40aa49822621713e0f79f6c9a187468251fc22559cb1bbd6b5f71a94819eeb7
SHA5123dda5f3133df4c00c03d8b3fb539b37e2e6b26d0384d3674cefa9595136f9eaa4b9d21c0e806a9ec3cfadfb782a30e344145abbf87bca813de056f84c6fb13c9
-
Filesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
Filesize
695KB
MD52af06e7424e4f53fa8ee2b8daf4cdaa3
SHA10a09aa095e38211b8fc512d2e9f8f7cf12159a19
SHA25681f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69
SHA5126bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16
-
Filesize
634KB
MD5bd1503d4eaae5e7f2a8cdbd9a88ec02a
SHA1730280a7839bb46bdeeaa47797d926f8d57e1da1
SHA256724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4
SHA5120dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b