Analysis
-
max time kernel
42s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 01:54
Static task
static1
Behavioral task
behavioral1
Sample
4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe
Resource
win7-20221111-en
General
-
Target
4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe
-
Size
931KB
-
MD5
d0d17876686f1eb0d65b25b55a5a04f5
-
SHA1
0687dafa029d3cae0691af29314a395a0fff01e3
-
SHA256
4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5
-
SHA512
d70731e846da10605bc8b93cc600dc737d90c1289e4008619b7b4d0b38ddbe6ba0d4aa580c237ec28e395053d336b610eab3a16849dd0502848ebb111d32fa98
-
SSDEEP
24576:h1OYdaOmCZ/iWCvu/2sWsJA/jlt+DHhsX:h1OsoCpYO/dJJDHhsX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
XbHnLGv6rjZ96a1.exepid process 1216 XbHnLGv6rjZ96a1.exe -
Loads dropped DLL 1 IoCs
Processes:
4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exepid process 308 4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
XbHnLGv6rjZ96a1.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdkcfncafebkkignagajoamjijgflla\2.0\manifest.json XbHnLGv6rjZ96a1.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdkcfncafebkkignagajoamjijgflla\2.0\manifest.json XbHnLGv6rjZ96a1.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdkcfncafebkkignagajoamjijgflla\2.0\manifest.json XbHnLGv6rjZ96a1.exe -
Drops file in System32 directory 4 IoCs
Processes:
XbHnLGv6rjZ96a1.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy XbHnLGv6rjZ96a1.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini XbHnLGv6rjZ96a1.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol XbHnLGv6rjZ96a1.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI XbHnLGv6rjZ96a1.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
XbHnLGv6rjZ96a1.exepid process 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe 1216 XbHnLGv6rjZ96a1.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
XbHnLGv6rjZ96a1.exedescription pid process Token: SeDebugPrivilege 1216 XbHnLGv6rjZ96a1.exe Token: SeDebugPrivilege 1216 XbHnLGv6rjZ96a1.exe Token: SeDebugPrivilege 1216 XbHnLGv6rjZ96a1.exe Token: SeDebugPrivilege 1216 XbHnLGv6rjZ96a1.exe Token: SeDebugPrivilege 1216 XbHnLGv6rjZ96a1.exe Token: SeDebugPrivilege 1216 XbHnLGv6rjZ96a1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exedescription pid process target process PID 308 wrote to memory of 1216 308 4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe XbHnLGv6rjZ96a1.exe PID 308 wrote to memory of 1216 308 4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe XbHnLGv6rjZ96a1.exe PID 308 wrote to memory of 1216 308 4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe XbHnLGv6rjZ96a1.exe PID 308 wrote to memory of 1216 308 4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe XbHnLGv6rjZ96a1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe"C:\Users\Admin\AppData\Local\Temp\4a788a8beead06782886e79fc83cb3746e6020f03b1230d8b79e268a0ef356c5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\XbHnLGv6rjZ96a1.exe.\XbHnLGv6rjZ96a1.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\[email protected]\chrome.manifestFilesize
35B
MD59204247a6a0fb0b372d9da7b6da7dbc8
SHA111dd5a014628c9a328e6b556fc841b447982477c
SHA2560f57a1a5cff4ccfdfaf6639561f711938355e0cf9ede4eb5271efe3fce852abc
SHA512eec080dfa53024000ad9d963e751e90dfe7ff91b789a48e5b5da9387c9b92d4b210d0dbea5fbfc8f17e0437de407a7a125f1be929187b03595189c51217b1a86
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\[email protected]\content\bg.jsFilesize
8KB
MD590031b655e637ba2aa5bf17b3632ecaa
SHA11429facacc86efac79f7d000869f2a0930a2bfc5
SHA2561406c24944ba621537c247599b78a63a2f323ab87b847fbf9f0e8179afcbf61a
SHA5126b5ee2dca4df3e2b30027d2f61c3678f80d3bb7a205ae64add31826706a088bcf5f3d7a7b825ec0c8f2cea252baf26f4fa8817cfb92eef1db18bafd446404e56
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\[email protected]\install.rdfFilesize
593B
MD5f7e8a221fcd8767c7b56b519da9e9ca1
SHA1a4af5eefeeb21cb78a4d23de450f98ae96b40424
SHA256c7901b1219199dd99ffcae7f56c85073110e9e4f04e34c7db04ce25f082c7700
SHA51238600018328c8d9934cc844e92c55f6c5e7d090019fb26d697951356d7475d281f62292beffcfc8a63cfdc7143f70c65f2be6c536009655b666aba6c8848c2ac
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\XbHnLGv6rjZ96a1.datFilesize
1KB
MD5d61d11a7210698822119f174caf65087
SHA1321e83c949f889f50ee452d15f0456d5faf3c3b6
SHA256394a766562df54add035b53965493eac5d55e9cafdaac92ef8a00a62518397e5
SHA512b2c5b2e1e11a2b54c066a8b692c14f92f8a11fda27374eac6bd16998439345c2fba1177e7cb54aa5e24f32a90acb287b546fe94fa054fd0e30bf663a1ece9cf2
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\XbHnLGv6rjZ96a1.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\cbdkcfncafebkkignagajoamjijgflla\URIeTG66.jsFilesize
6KB
MD5326fc62e5c0399db66072479055f0f02
SHA12355e5c6b128283ec04e580772c95428d9be3c98
SHA2561cc57b1f752be81ffe4b023eb91553e6d8a35a25df2abd8ef08033bcf9fe4984
SHA5121352d71036bdce2c6b7a77fd98d470bba5418caeaec8e51222eb61412480a8364df4cf1c80b2bff2d67d008c2fa57db18a32c54d1cd11b4fb847b9df5d2265f4
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\cbdkcfncafebkkignagajoamjijgflla\background.htmlFilesize
145B
MD5b27bcdd1ac7a282c9c3fd17b7edb6ce9
SHA1ccf78bd16ca12080a4217e278a5e4e80ac18e8ad
SHA256825b51c93a85f5149d6580e96f3311e6e963a9c5f925030daf2009784aab735f
SHA5128469c9172419081cc2f0eecdde4560ae06cfd538388773fcb882c994dde988908c9e6d15d29f50e5b3c13865a8f6dbe28f97f7c1d7960193fd744b37eb4a9807
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\cbdkcfncafebkkignagajoamjijgflla\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\cbdkcfncafebkkignagajoamjijgflla\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\cbdkcfncafebkkignagajoamjijgflla\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zS46B2.tmp\XbHnLGv6rjZ96a1.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/308-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1216-56-0x0000000000000000-mapping.dmp