52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72

General

Target

52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe
Size

920KB
MD5

cd60ca5be701eb94b9a6b2397c7fd292
SHA1

d784326a97251248b27e06480e1683fa8b19d2d7
SHA256

52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72
SHA512

c2ba6adf6211a803e90a2fe3a4442185b9b0d479687c40da00ec97d99f7a2f20e8909f7d9e26e8559c814da09211d6c5ba8d7f37f111c0d74bdbf38e82b40979
SSDEEP

24576:h1OYdaOVCZ/iWCvu/2sWsJA/jlt+DHhsc:h1OsDCpYO/dJJDHhsc

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

L0crfqzL4BACmlu.exe

pid process

4028 L0crfqzL4BACmlu.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4028	L0crfqzL4BACmlu.exe

Drops Chrome extension 5 IoCs

Processes:

L0crfqzL4BACmlu.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekpdpmpcgcmpaeokmclflfpadaklgpji\162\manifest.json	L0crfqzL4BACmlu.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekpdpmpcgcmpaeokmclflfpadaklgpji\162\manifest.json	L0crfqzL4BACmlu.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekpdpmpcgcmpaeokmclflfpadaklgpji\162\manifest.json	L0crfqzL4BACmlu.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekpdpmpcgcmpaeokmclflfpadaklgpji\162\manifest.json	L0crfqzL4BACmlu.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekpdpmpcgcmpaeokmclflfpadaklgpji\162\manifest.json	L0crfqzL4BACmlu.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

L0crfqzL4BACmlu.exe

pid process

4028 L0crfqzL4BACmlu.exe
4028 L0crfqzL4BACmlu.exe

pid	process
4028	L0crfqzL4BACmlu.exe
4028	L0crfqzL4BACmlu.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe

description	pid	process	target process
PID 4908 wrote to memory of 4028	4908	52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe	L0crfqzL4BACmlu.exe
PID 4908 wrote to memory of 4028	4908	52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe	L0crfqzL4BACmlu.exe
PID 4908 wrote to memory of 4028	4908	52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe	L0crfqzL4BACmlu.exe

C:\Users\Admin\AppData\Local\Temp\52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe
"C:\Users\Admin\AppData\Local\Temp\52d801d1458a2d35579848fa6b5458d936433634da6fd427d4557f61cc63bc72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\L0crfqzL4BACmlu.exe
.\L0crfqzL4BACmlu.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\L0crfqzL4BACmlu.dat

Filesize
1KB

MD5
7eaf833d8bea3bf35ac1bbcc5920c4d5

SHA1
e4a9eeae222e837377e777993bfde575ab105f0e

SHA256
6769ef388180b49fe12941cbfd551f659706583571a861e00e5666f32aeb5896

SHA512
0d9be77ae5d528b75e38f2ad3c8e1bd1087b15a5f07db47708786aff9b1a4cb96d4ec42c15a9baf2711f6465b3b0754ca7b898079a1b076411f44cbf6ef4dcab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\L0crfqzL4BACmlu.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\L0crfqzL4BACmlu.exe

Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\ekpdpmpcgcmpaeokmclflfpadaklgpji\background.html

Filesize
146B

MD5
228c8f96748d9bc85bfce648a641ba48

SHA1
69a97643c6288aa159634b6842ec91af348712f3

SHA256
706ab961562d7fc24f86afdcefcdc2b05db835b07b4f26d294a469c5617f2cf8

SHA512
22dd5d0d28042b5d50d6ed758931b884f7e3be97b7726d4c438f78da46dcc2dbfb4769191bbe47e2a44b76f14644024c12b3124297baf166667a0a76fc3b231f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\ekpdpmpcgcmpaeokmclflfpadaklgpji\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\ekpdpmpcgcmpaeokmclflfpadaklgpji\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\ekpdpmpcgcmpaeokmclflfpadaklgpji\manifest.json

Filesize
613B

MD5
c251c3d2771d332cc4f76754b53f9498

SHA1
4e50b8295e0c4d41d1040532f2fcf3a8392f0d0c

SHA256
250a56c09957c353b52a8ce2a01ec14d043f7ae6e4ef7ee4d9dd069da739c12f

SHA512
c741fd7ffc5c3256ab02d89ae3bfbcb87001d5138afc43c4f7cd9389d7ac120defe44fa9510449a40fb7d7588c7a582116ab1b770c455f48a9f7a3866c59a5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF1B4.tmp\ekpdpmpcgcmpaeokmclflfpadaklgpji\meRTx0aYD.js

Filesize
7KB

MD5
2ccfa29fc1d2f642f9542e359371bdca

SHA1
e388daf6a7528ad0ccdd636ae2bf246709c4bf90

SHA256
2e74c28f98850173f8bb077ce26ea35c7b97df790984c1da87a0ae32813061d1

SHA512
b5f91b0b7759c52c871514320f6418029c39b66eb640df043553ba6a1800cb3821cfeaf5dab033a44f946a07d2637ce5c1c25a4d6d25587a23270e08587aa480

Download Submit
memory/4028-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing