2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5

Analysis

max time kernel
5s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe
Size

1005KB
MD5

d3d1c16e8b566bcd76d70dafe01e93cd
SHA1

0e487224877ca8f5b7d7039da37fb9da4b0d4653
SHA256

2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5
SHA512

a5a0f85f80afc1fcebf68b6f4ca6fdb34fc714bcb950fe6383c79f0de9f047aac398f6dd913b6b99b44466e21510711475dea8fecd815dd5128b2a7f0ec7da50
SSDEEP

24576:QZnHDNXwe8JzQsn4FJJe8NQ9dk0rNNvZXJh:0DN/8JzQ24FJJe8NQ9dk0rN9vh

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1800	W9XvpHGQxIhztnk.exe

Loads dropped DLL 1 IoCs

pid	Process
1552	2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjiigapfihndlcojlpjackjmcpolpgjb\2.0\manifest.json	W9XvpHGQxIhztnk.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjiigapfihndlcojlpjackjmcpolpgjb\2.0\manifest.json	W9XvpHGQxIhztnk.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjiigapfihndlcojlpjackjmcpolpgjb\2.0\manifest.json	W9XvpHGQxIhztnk.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	W9XvpHGQxIhztnk.exe
File opened for modification	C:\Windows\System32\GroupPolicy	W9XvpHGQxIhztnk.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	W9XvpHGQxIhztnk.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	W9XvpHGQxIhztnk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	W9XvpHGQxIhztnk.exe
1800	W9XvpHGQxIhztnk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1800	1552	2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe	28
PID 1552 wrote to memory of 1800	1552	2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe	28
PID 1552 wrote to memory of 1800	1552	2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe	28
PID 1552 wrote to memory of 1800	1552	2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe	28

C:\Users\Admin\AppData\Local\Temp\2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe
"C:\Users\Admin\AppData\Local\Temp\2fd3f5922984a8aac76e8b6eebbb1c2c37349c7787485dc94a540fd14d203ab5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\7eae3834\W9XvpHGQxIhztnk.exe
  "C:\Users\Admin\AppData\Local\Temp/7eae3834/W9XvpHGQxIhztnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7eae3834\W9XvpHGQxIhztnk.dat

Filesize
1KB

MD5
bac312d7be5270817efb3c0b5ef2220f

SHA1
6cd2895b21fc5edbf154358d2f71590ab2cf742f

SHA256
85c55e7b3a0d9c025553a960ef51a34fb1dd6027db4d79d59b61c4f0096e523f

SHA512
df3632f6d7fdfa9838fa6c794f0e0f65c75ad31e939d619d9d8cb8bb5e89b3168631c8b9d17aa73335ac3cf30627c502eb92191a6d3b6912c3165e83944ca2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\W9XvpHGQxIhztnk.exe

Filesize
623KB

MD5
3b14889741773801d5e21eeb824b8839

SHA1
3eb3ad8aed386bf6c8c04379adc6e9a05783f9cd

SHA256
8618340890f3d1ad97776e9638cb4d546d928a42e6c05a97311fb6d869e775dd

SHA512
128c2c6c260a5eccf5c678561fb6e6e498998fb43f2970929e2bea8288a2eff56b04c512fd2506ce1ff214799be264c550840f3cfc1150522125fc25a9db7057

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\[email protected]\chrome.manifest

Filesize
35B

MD5
83102c0bfd7ab2feb9407ada6c1f152b

SHA1
4aa4e0e0ea7e32e17027fe6ccbc0240b7ef85457

SHA256
49a97f4a0eb6356417fee69d0a2fa806ab182f2ba9c27ac9712d506e945518b9

SHA512
2917aa493257276fb8fbbd00806b3cc6d4d5cc8c901cf91a80474026be60e0815bf1e85de2a070fd21c5a4194cf83bed87b22e249e47d7bbe780f633c4ad9bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\[email protected]\content\bg.js

Filesize
8KB

MD5
b9c5c7728a5554574c044511158eb788

SHA1
0a8550a459a5659898596ba289a4dd12cd62200b

SHA256
8118664bf64a4a59c62c91977eaa43fb1a1144a714894eb2833415a82feab34b

SHA512
f0d555d87737140e8866cf1ef0349685ba1fd085e3817a4a9fcf13f9752ee19b3541457c01fc5763d2c37f7fcea434a2b9504d75d8e9a2252781964cb8a9ce87

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\[email protected]\install.rdf

Filesize
597B

MD5
37fd7d3af26c11b0f85c299f456f64d6

SHA1
3c0c7f5053dbde3fc2f2d991265da3d9e44bd76f

SHA256
cae1c9e14dcaab90c69323cf96c756c7610fc7d32d0e395ad48ce7bd4626db01

SHA512
ea9b57db2fa482c4c823de2ca66de410f936c2714d2d5077ce2dc6d92ce1944ec12cfec0a1dd79531215ced915ba6f71e139eba9ed98f989e6b223e171eb2657

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\kjiigapfihndlcojlpjackjmcpolpgjb\background.html

Filesize
139B

MD5
a0f0ca48b5be7d698924842c3a45aa7f

SHA1
4b32730dfcf3c7aa4648000d28c80ee802b817f2

SHA256
73588df0a60ff9f4e1db41ea421c27ade40cedb45de3ec0ca70bab5dac993629

SHA512
4096f2934048f21ad201027764aacd5424a8a931928c63210f2ad69f1fa78c2577cb81a122252f6db38fcfa404812914d66d1c1559f28478d33b5fa14f84a614

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\kjiigapfihndlcojlpjackjmcpolpgjb\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\kjiigapfihndlcojlpjackjmcpolpgjb\fI.js

Filesize
6KB

MD5
26f287d57e7b5d2f20221547c0bfb401

SHA1
45812117a44ce65d5c498ea7cdf84bbb481aa024

SHA256
033098f09bdca4547f6c0f4693397f4d43f153e8e5f74edf618cee81d0168b53

SHA512
b2ed53c04fb5114fe98b426865cedb380478907fed90d28ee86b58cc2e701b461e29872c212e43e7db5fbfa65d1090edb68ac4b24353c62557f705021167c140

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\kjiigapfihndlcojlpjackjmcpolpgjb\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eae3834\kjiigapfihndlcojlpjackjmcpolpgjb\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
\Users\Admin\AppData\Local\Temp\7eae3834\W9XvpHGQxIhztnk.exe

Filesize
623KB

MD5
3b14889741773801d5e21eeb824b8839

SHA1
3eb3ad8aed386bf6c8c04379adc6e9a05783f9cd

SHA256
8618340890f3d1ad97776e9638cb4d546d928a42e6c05a97311fb6d869e775dd

SHA512
128c2c6c260a5eccf5c678561fb6e6e498998fb43f2970929e2bea8288a2eff56b04c512fd2506ce1ff214799be264c550840f3cfc1150522125fc25a9db7057

Download Submit
memory/1552-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download