Analysis

  • max time kernel
    229s
  • max time network
    333s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 21:36

General

  • Target

    843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe

  • Size

    2.1MB

  • MD5

    c7e133b809037dd474bab282e9ee0baf

  • SHA1

    4039cd2d7590a2b8c784eeaed4ab1aa2b20faca4

  • SHA256

    843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae

  • SHA512

    b176eaa212524d9cbd5194aec98da0adfca66a968a5e9ad068877608b62348f15ea7ed6af9aa734d2b0cfd0338deada7570e7aa9f7b39f6bae887f3f0eaadecf

  • SSDEEP

    49152:h1OsIhvaZG1MVEtzijkTvu2x/uw4B8FHFF6U:h1OHvaxMziy3V

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe
    "C:\Users\Admin\AppData\Local\Temp\843a14c74eb8e8a0e23ac0224b55d0a5f09f6e844aa201ee82c1b718c2b6ebae.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\Ga6xbO5i397d9Nu.exe
      .\Ga6xbO5i397d9Nu.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:364

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.dat

    Filesize

    6KB

    MD5

    50e5b5013989b82868a471aee708b531

    SHA1

    406ba1cd9dbb609b6132832bca9735a7fd8d550e

    SHA256

    c11d4288f3d9693e581d7dec5e813d7d230db3199ba45ec3b305c528ed7b0ad9

    SHA512

    d3daec154c35242f9bb9dd802eaff9b690dd8fded1e297b660cdfec5c2bf09a33123377a1afc2117827360ca6cd5ad9457ebf3133a1a076754fa1357fc90cb5f

  • C:\Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll

    Filesize

    695KB

    MD5

    2af06e7424e4f53fa8ee2b8daf4cdaa3

    SHA1

    0a09aa095e38211b8fc512d2e9f8f7cf12159a19

    SHA256

    81f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69

    SHA512

    6bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\Ga6xbO5i397d9Nu.dat

    Filesize

    6KB

    MD5

    50e5b5013989b82868a471aee708b531

    SHA1

    406ba1cd9dbb609b6132832bca9735a7fd8d550e

    SHA256

    c11d4288f3d9693e581d7dec5e813d7d230db3199ba45ec3b305c528ed7b0ad9

    SHA512

    d3daec154c35242f9bb9dd802eaff9b690dd8fded1e297b660cdfec5c2bf09a33123377a1afc2117827360ca6cd5ad9457ebf3133a1a076754fa1357fc90cb5f

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\Ga6xbO5i397d9Nu.exe

    Filesize

    634KB

    MD5

    bd1503d4eaae5e7f2a8cdbd9a88ec02a

    SHA1

    730280a7839bb46bdeeaa47797d926f8d57e1da1

    SHA256

    724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4

    SHA512

    0dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\Ga6xbO5i397d9Nu.exe

    Filesize

    634KB

    MD5

    bd1503d4eaae5e7f2a8cdbd9a88ec02a

    SHA1

    730280a7839bb46bdeeaa47797d926f8d57e1da1

    SHA256

    724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4

    SHA512

    0dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    050cc2c401bf190a7028d106a514de3b

    SHA1

    fc4cf2a4a8e80a5162234509bafb52f476603378

    SHA256

    ab468540403542ba4bd7a94319b07aeaddeaa65512d3992f11b2f361623f5d7a

    SHA512

    bf0ca3d6078b2a6daad23736e9eeb873b1269fed50d511f77574aa41aa5a521e7db40a01988d63d97e579f4c44f94e2047413894ebfb37ae7217987eadc1de1e

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    4756cf768398cd97798aba79c449a3bb

    SHA1

    81b50e0256843eca3d64219ea12ffb409c338131

    SHA256

    97afc49147aefb90651cba1cd0dfff1da7cf881ba2e0f442e785e8c07e05ec12

    SHA512

    19f3d795234a93270032dc0c0df47912b14adab67522344282128d3fdaca6a213f555039ffc401083cd649365299fd8fca102f1cb488fd68b527dea1c16e2c7c

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\[email protected]\install.rdf

    Filesize

    592B

    MD5

    32dae9c1a7c79b2a73ccf7f139845caf

    SHA1

    b5a34844efd8891ed0210ed66749cf48a290f24b

    SHA256

    1c9b7f47882c0e3dcc74a09a5b2484a8b6c832598443647cef96bb1b85417760

    SHA512

    332cce7a9b48cea6f55705848f49348c47dc3148e3180e15fd86af8120e3887aed3a679757cc54092487bb805dd81161b90359b26529837d42cb5b26bf4a0ff2

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\ZZA3CHEtRRcXmS.dll

    Filesize

    618KB

    MD5

    f180a95d8673cd01ce4af0ff678fa099

    SHA1

    8592fe958436e14ef9ace437ac4445ecca22e35e

    SHA256

    d40aa49822621713e0f79f6c9a187468251fc22559cb1bbd6b5f71a94819eeb7

    SHA512

    3dda5f3133df4c00c03d8b3fb539b37e2e6b26d0384d3674cefa9595136f9eaa4b9d21c0e806a9ec3cfadfb782a30e344145abbf87bca813de056f84c6fb13c9

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\ZZA3CHEtRRcXmS.tlb

    Filesize

    3KB

    MD5

    8af6f42a5b16ced04702514d47052053

    SHA1

    f06e43c9710e27b38063652217874f6fc8515ea0

    SHA256

    0fc752f18e2f21a6d0b45fb9769deefe70d4690e72225037a37d1dc0553ae8ed

    SHA512

    2d1fedf6693f0347d9265436fbc17515fa9a904db54170181ca7a6d5c64a4928494a20a1eb489d646602ed2769e570bfb5835bffd241a53a8fe64d5767b9234b

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\ZZA3CHEtRRcXmS.x64.dll

    Filesize

    695KB

    MD5

    2af06e7424e4f53fa8ee2b8daf4cdaa3

    SHA1

    0a09aa095e38211b8fc512d2e9f8f7cf12159a19

    SHA256

    81f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69

    SHA512

    6bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\background.html

    Filesize

    138B

    MD5

    af5168de756b9a53a8b970b0e95139a6

    SHA1

    0fe25eb8bb6919808de08d59dd3a09a2cdaba3f3

    SHA256

    4b937c436472ad4670a555265f93f078bcf4ea5faefccf7ff5c137a482731b69

    SHA512

    8d1597aae1e07a990dfe000466e4609ff582a095094df0e18e5683a8761906aca3d0b905a1f65f38212e21bbb5b0621f130fa66d2233e197878c2b9365c75c64

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\manifest.json

    Filesize

    499B

    MD5

    9ff3b6507d9edff1aa02443f76234ce4

    SHA1

    f88f4520c20d853858c09b5cdcc2720ebfa715b6

    SHA256

    e09b67786820607df16b9e864f3b2a23ff5908ca3b13b2f14f6cdca052f46efd

    SHA512

    9e84a3c3cbcb53a7a987d9e34a867caa1ec680ee29d37ad233a84ee67950fc1325c98cb6820194829da3aadfc73aec618e29f01b687ced36899c4bd2eb51edfd

  • C:\Users\Admin\AppData\Local\Temp\7zS6671.tmp\kjjokjjlhlmfbdpoelbhoejpcjoiicjo\o.js

    Filesize

    5KB

    MD5

    dd3befbc50bd5d37d87f0c933ae9cb7b

    SHA1

    b15937c5d2dccce0513e7c36d884f3d2324c7449

    SHA256

    6bd2d3b1cddd4c066d40d049f4610456c95acc41ecfb7b2631bb1f1d21e670a4

    SHA512

    95c1177c5ea258fa5fbb5c72400f4d6cd72589ad7589c63530905fd80dad6bc07433e80f41e3d46b4687c3dd7f853ab6cfbd6da0d0781dd68e7a670aeaf05303

  • \Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.dll

    Filesize

    618KB

    MD5

    f180a95d8673cd01ce4af0ff678fa099

    SHA1

    8592fe958436e14ef9ace437ac4445ecca22e35e

    SHA256

    d40aa49822621713e0f79f6c9a187468251fc22559cb1bbd6b5f71a94819eeb7

    SHA512

    3dda5f3133df4c00c03d8b3fb539b37e2e6b26d0384d3674cefa9595136f9eaa4b9d21c0e806a9ec3cfadfb782a30e344145abbf87bca813de056f84c6fb13c9

  • \Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll

    Filesize

    695KB

    MD5

    2af06e7424e4f53fa8ee2b8daf4cdaa3

    SHA1

    0a09aa095e38211b8fc512d2e9f8f7cf12159a19

    SHA256

    81f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69

    SHA512

    6bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16

  • \Program Files (x86)\VaaudiX\ZZA3CHEtRRcXmS.x64.dll

    Filesize

    695KB

    MD5

    2af06e7424e4f53fa8ee2b8daf4cdaa3

    SHA1

    0a09aa095e38211b8fc512d2e9f8f7cf12159a19

    SHA256

    81f98c4034227951bd4ad5e6d6a823bd112602f3550fd7066a01f16b8c8aca69

    SHA512

    6bcaa8998bd7971f41bebc8433be949cf48d98c0eb70c643b7b7a1b50d2b4cf66412efb170684f36f1987c1992ba88350f815ea18a3cf50caf8ce97bbb961b16

  • \Users\Admin\AppData\Local\Temp\7zS6671.tmp\Ga6xbO5i397d9Nu.exe

    Filesize

    634KB

    MD5

    bd1503d4eaae5e7f2a8cdbd9a88ec02a

    SHA1

    730280a7839bb46bdeeaa47797d926f8d57e1da1

    SHA256

    724380928512fc5261d5f42e64f7705fcdeae1410f24a8ec6b0a2ba783675cb4

    SHA512

    0dc06ce8e78f6b0ebbe65723791ea4ffde8a9d55534dda1b02e81f1a109fce77f26e4bdfb9fd18b5ca9f4d9ff2454e6b05eca325539148512f762b5d2f225c7b

  • memory/364-77-0x0000000000000000-mapping.dmp

  • memory/364-78-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

    Filesize

    8KB

  • memory/1352-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

    Filesize

    8KB

  • memory/1668-73-0x0000000000000000-mapping.dmp

  • memory/1696-56-0x0000000000000000-mapping.dmp