Analysis
-
max time kernel
224s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 01:54
Static task
static1
Behavioral task
behavioral1
Sample
4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe
Resource
win7-20221111-en
General
-
Target
4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe
-
Size
2.5MB
-
MD5
f89c6145acbbec722b2cddfd2f032f9d
-
SHA1
429477236811bc2980a20778cb55ad17d6c43f76
-
SHA256
4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29
-
SHA512
077456a69307e1fc82e90f4d370b27a124f99a0a65ca6070b3296f02e8aa6b4398e8150ba2aebdb2fbc1385c4313e12e5f59838b833e9cba9019e148fb1c5689
-
SSDEEP
49152:h1Os6sNQH0eNGTTOxTnkSM1XN+QMz3p6bOkAk+YetEW6FOCMwEFhjzdUwM:h1OrH0eNGunkt3+1z3p6iVCR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
YiLiQLNXv4lywU8.exepid process 1716 YiLiQLNXv4lywU8.exe -
Loads dropped DLL 4 IoCs
Processes:
4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exeYiLiQLNXv4lywU8.exeregsvr32.exeregsvr32.exepid process 580 4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe 1716 YiLiQLNXv4lywU8.exe 1448 regsvr32.exe 1440 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
YiLiQLNXv4lywU8.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimpeojagmeedcbbnjhpcjnlebigcckb\3.7\manifest.json YiLiQLNXv4lywU8.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimpeojagmeedcbbnjhpcjnlebigcckb\3.7\manifest.json YiLiQLNXv4lywU8.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimpeojagmeedcbbnjhpcjnlebigcckb\3.7\manifest.json YiLiQLNXv4lywU8.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeYiLiQLNXv4lywU8.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects YiLiQLNXv4lywU8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} YiLiQLNXv4lywU8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ YiLiQLNXv4lywU8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} YiLiQLNXv4lywU8.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} YiLiQLNXv4lywU8.exe -
Drops file in Program Files directory 8 IoCs
Processes:
YiLiQLNXv4lywU8.exedescription ioc process File created C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.dll YiLiQLNXv4lywU8.exe File opened for modification C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.dll YiLiQLNXv4lywU8.exe File created C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.tlb YiLiQLNXv4lywU8.exe File opened for modification C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.tlb YiLiQLNXv4lywU8.exe File created C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.dat YiLiQLNXv4lywU8.exe File opened for modification C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.dat YiLiQLNXv4lywU8.exe File created C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dll YiLiQLNXv4lywU8.exe File opened for modification C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dll YiLiQLNXv4lywU8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
YiLiQLNXv4lywU8.exepid process 1716 YiLiQLNXv4lywU8.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exeYiLiQLNXv4lywU8.exeregsvr32.exedescription pid process target process PID 580 wrote to memory of 1716 580 4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe YiLiQLNXv4lywU8.exe PID 580 wrote to memory of 1716 580 4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe YiLiQLNXv4lywU8.exe PID 580 wrote to memory of 1716 580 4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe YiLiQLNXv4lywU8.exe PID 580 wrote to memory of 1716 580 4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe YiLiQLNXv4lywU8.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1716 wrote to memory of 1448 1716 YiLiQLNXv4lywU8.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe PID 1448 wrote to memory of 1440 1448 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe"C:\Users\Admin\AppData\Local\Temp\4a7b9302123a2a59083a534a606518939da5f3ff23b898c33c23f0850c8bcc29.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\YiLiQLNXv4lywU8.exe.\YiLiQLNXv4lywU8.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.datFilesize
6KB
MD54ab827e879464d3711ed9be6e0fb21a7
SHA14885982e084a5aaa1b3955dff95695aa2ff5d917
SHA2564f5df24007b05f10a7558c34a964bc912b5a898c39986f2ba37ade1523435e0f
SHA512eb1c9eff2d99eabe054f2d2e35eff8539593d11a2494b4c6d838027057ee5621ab44ac774a125cff5880d5d965177f92819f31425db14ef750dfd2a20c7d2e38
-
C:\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\[email protected]\chrome.manifestFilesize
35B
MD5a6631f80206be2fc11adf13a9f878582
SHA1c76e1299ed1978c0fc43430637c97291ce78aed0
SHA256f23776a5a5e67ca6654165f1bf0c035fa0de2c5e5cc7ba6931154c6946d4076e
SHA51278388b38f6762d78185e5391f97f58068981cb09c208a19efcaec0fbbc32132720dd4ad645f6c860e38c4fc9656318199407f15909499e9a64fcabffa6ef9d0f
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\[email protected]\content\bg.jsFilesize
7KB
MD50acf351d1d2d5126a760cfe3a48e002b
SHA193c77603d528c3374ce5d2dcef1a7a910cd23e99
SHA2566f92ba478f7fc282ce90ee1cdcfd1ccbcc7572fa3fa3dc265bd6536adc63c37b
SHA512f9788a7c1d98002f067978acef01188a9e4941f228aeb916c6ef2c565e614f21e9013a1900554affb6330ef6b1455f2db797a16eaa753bc2ee2ab083e0a95d48
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\[email protected]\install.rdfFilesize
596B
MD516864243275a5ff1227ad0f8ec23d177
SHA1e5558c0817c730a66a4b2a5a4ec86e19717fd9af
SHA256430293aeb718989b32d151480fa9215b6d40bc1fa7579f4ce0420b561ac1a726
SHA5128cb1d5e18776f9ef52052fec7d5dc1c5fa6f943bf3da910d095e61e20b05b2e02ad4314d883a56acb8054d49dce29c1256dbe866b8e81888979d4d0a2f833b3b
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\WZWrOCA7GgPnIk.dllFilesize
754KB
MD50ea14ffbf9bc129f87d5a633ca028a12
SHA1c91e00a9d6590556a4c13a46cb6c934f84cf2b2b
SHA2569206058e3e04af4fb8d5c05ae8f088cf0a289ea0e4cd692c4f2d76439adb0d47
SHA5120cfd075335346690ead8c5aef2340b56ce07c59d6243ad102fee0053d64f1a7847e56ba27f5bbcac4048f2c1cf70038e7cdffafe1cc28994603fdd65d2bf7bb2
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\WZWrOCA7GgPnIk.tlbFilesize
3KB
MD54ab2bba691d66beca01f76ac65546fe8
SHA116f05ce91f3e2fe4b43452e24d56836fc65615af
SHA25612816936003f13a1711de73328e38f311926a4cc9d1a836f46c9ccc02b6fb06f
SHA512f034390bfd57618bbfd218c3df9e465dda8f4fa51fc0445c74e246472a4cde2bc0bfe4607cbc8cb31ac0edff62a84e954179fadddc2b644b8726cfa3e01694a2
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\WZWrOCA7GgPnIk.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\YiLiQLNXv4lywU8.datFilesize
6KB
MD54ab827e879464d3711ed9be6e0fb21a7
SHA14885982e084a5aaa1b3955dff95695aa2ff5d917
SHA2564f5df24007b05f10a7558c34a964bc912b5a898c39986f2ba37ade1523435e0f
SHA512eb1c9eff2d99eabe054f2d2e35eff8539593d11a2494b4c6d838027057ee5621ab44ac774a125cff5880d5d965177f92819f31425db14ef750dfd2a20c7d2e38
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\YiLiQLNXv4lywU8.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\YiLiQLNXv4lywU8.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\eimpeojagmeedcbbnjhpcjnlebigcckb\W8pA5KLLiZ.jsFilesize
5KB
MD59bc89ae85eadbabe636bbddf6ac7d213
SHA1352c1a890ba107a8325cc36e72154c3533e7779c
SHA2568980632061888e41195aaffbf8c01efd65c2446f9d9f178717e794d641a059ee
SHA5125c61347cf1f672243e15e1eec0afad7f14fafb1222d6ff35c58eafcc9bf06f2ff8e03ab6e12e9e22eb0c80e9a3347217eed6038897ab5be15e44a6421dfc6e54
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\eimpeojagmeedcbbnjhpcjnlebigcckb\background.htmlFilesize
147B
MD5f79ac2b63505bf0983a9f3d6efff6aef
SHA1f9a391c75fc999b26f23c36c48fc9cb6332517f1
SHA256c8a656b0e1db5bb4c8f655771cfd023669d9ab965de368d1cb03272aa978deeb
SHA5129d153ef2a3ebb7fc4e83c1a9179720e9f39f745b7583981fb1d0e4a0b53ceee73abd7ab6c73f2a94a09287af330f0c84ad37dc3eb83582fdad110285701721d1
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\eimpeojagmeedcbbnjhpcjnlebigcckb\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\eimpeojagmeedcbbnjhpcjnlebigcckb\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\eimpeojagmeedcbbnjhpcjnlebigcckb\manifest.jsonFilesize
499B
MD5f6da34f727bd43075d13ea3c24cc5faf
SHA18aede51366d86e39b14718228831c1c198b4355c
SHA25691b8694c1ec2c0408c90ac98e8c40e4c08f1a04365163d44b1507a0d7838d221
SHA5120326e0734db861ce2404f6b338e517ae2ec6c3cf0bdb62764ccd1fa4e710750ecb2622bdb1d45c737bfaf210227b229d8e87d99942088a8ee0ed4ca39c013527
-
\Program Files (x86)\websave\WZWrOCA7GgPnIk.dllFilesize
754KB
MD50ea14ffbf9bc129f87d5a633ca028a12
SHA1c91e00a9d6590556a4c13a46cb6c934f84cf2b2b
SHA2569206058e3e04af4fb8d5c05ae8f088cf0a289ea0e4cd692c4f2d76439adb0d47
SHA5120cfd075335346690ead8c5aef2340b56ce07c59d6243ad102fee0053d64f1a7847e56ba27f5bbcac4048f2c1cf70038e7cdffafe1cc28994603fdd65d2bf7bb2
-
\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
\Program Files (x86)\websave\WZWrOCA7GgPnIk.x64.dllFilesize
891KB
MD5bef492ffc032769cde00802f48a17fab
SHA1a91e733c1269eb785f8e23dc475acac7432f0563
SHA256473507950695ec743b98e5ef4b8970b2c7e6936556903c94f7fa88917265255d
SHA5124f61d5f3a45d20cd00ed7ee6b874bf2dcbf248b8f65dfd8580c7148d6c71c316cace409be675a2ea919e8a12caf8690fafaf14c0f5479df55689401d2432afa0
-
\Users\Admin\AppData\Local\Temp\7zS38EC.tmp\YiLiQLNXv4lywU8.exeFilesize
774KB
MD5fac681323e2e0ea322ef16fa551cf1e8
SHA1744f89e591a6ced737cfe9214ce09c263de50211
SHA256537f2df71a2f21f943a39d1c6d093a442e7ee975ed3e29b733b8bc5bf646793c
SHA51222626bd0e79edac062b61d64234f563e3a8218703276a19a0b01749e2cad8387c8bd39bfe13810b787fb9e4c7f1669ea542e36bbf63c7c243fc68bb6fdf5c7b2
-
memory/580-54-0x0000000076D71000-0x0000000076D73000-memory.dmpFilesize
8KB
-
memory/1440-77-0x0000000000000000-mapping.dmp
-
memory/1440-78-0x000007FEFC461000-0x000007FEFC463000-memory.dmpFilesize
8KB
-
memory/1448-73-0x0000000000000000-mapping.dmp
-
memory/1716-56-0x0000000000000000-mapping.dmp