Analysis
-
max time kernel
164s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 01:54
Static task
static1
Behavioral task
behavioral1
Sample
4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe
Resource
win7-20221111-en
General
-
Target
4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe
-
Size
931KB
-
MD5
055837246331ff41823759d885bfdc3a
-
SHA1
0f0d5a3ecbc65e65b4b90ae4de909dcb43c219dd
-
SHA256
4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d
-
SHA512
2b5625e0da49f71d3ced94d0244630d72fa58fd10e70531f445215495dce7ec6c88c10fdb7861197fe700d35bfb53be8edd8e17269e58011b69b34418c2d427f
-
SSDEEP
24576:h1OYdaOwCZ/iWCvu/2sWsJA/jlt+DHhsB:h1Os6CpYO/dJJDHhsB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
k2mOMvV4f97l9zT.exepid process 3264 k2mOMvV4f97l9zT.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
k2mOMvV4f97l9zT.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\acmnemahikflikdleabkacdlkbofjpcg\2.0\manifest.json k2mOMvV4f97l9zT.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\acmnemahikflikdleabkacdlkbofjpcg\2.0\manifest.json k2mOMvV4f97l9zT.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\acmnemahikflikdleabkacdlkbofjpcg\2.0\manifest.json k2mOMvV4f97l9zT.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\acmnemahikflikdleabkacdlkbofjpcg\2.0\manifest.json k2mOMvV4f97l9zT.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\acmnemahikflikdleabkacdlkbofjpcg\2.0\manifest.json k2mOMvV4f97l9zT.exe -
Drops file in System32 directory 4 IoCs
Processes:
k2mOMvV4f97l9zT.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini k2mOMvV4f97l9zT.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol k2mOMvV4f97l9zT.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI k2mOMvV4f97l9zT.exe File opened for modification C:\Windows\System32\GroupPolicy k2mOMvV4f97l9zT.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
k2mOMvV4f97l9zT.exepid process 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe 3264 k2mOMvV4f97l9zT.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
k2mOMvV4f97l9zT.exedescription pid process Token: SeDebugPrivilege 3264 k2mOMvV4f97l9zT.exe Token: SeDebugPrivilege 3264 k2mOMvV4f97l9zT.exe Token: SeDebugPrivilege 3264 k2mOMvV4f97l9zT.exe Token: SeDebugPrivilege 3264 k2mOMvV4f97l9zT.exe Token: SeDebugPrivilege 3264 k2mOMvV4f97l9zT.exe Token: SeDebugPrivilege 3264 k2mOMvV4f97l9zT.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exedescription pid process target process PID 4244 wrote to memory of 3264 4244 4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe k2mOMvV4f97l9zT.exe PID 4244 wrote to memory of 3264 4244 4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe k2mOMvV4f97l9zT.exe PID 4244 wrote to memory of 3264 4244 4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe k2mOMvV4f97l9zT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe"C:\Users\Admin\AppData\Local\Temp\4a77be6ecf6173bce8c6be303e453e17aa31f5d343b5a2f200502fab7d00eb8d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\k2mOMvV4f97l9zT.exe.\k2mOMvV4f97l9zT.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\acmnemahikflikdleabkacdlkbofjpcg\FoMCn7nzYX.jsFilesize
6KB
MD5f02f3797471448960e11c8e43fa9ee67
SHA120bbd6de61c04e2ca775ea924bb83224ea4ed292
SHA256d51facecf1a25477acf86d2c8c2db8e59605332841a3daeaa5b54b7a07158f9c
SHA5120c64760e4436f7f7c1267c68675dc36c137f49cbfdfaf9566cb68b013813c040e0d9153574c137219dc8ab7bf80de86c9c9067b57abb38f664ac1b353d41fa12
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\acmnemahikflikdleabkacdlkbofjpcg\background.htmlFilesize
147B
MD54836d88fcdb0bce3279fc0d37425af93
SHA15add9565a6b51b7f0e8b6e3cc915898f73a03073
SHA256f3af3e626fe0e11fb08734eab6abb7e8e285c3e1374e61122f8885e1a467f311
SHA5129008e4385c64eeead030f9d5f52a06b2ef98c1d0e7281251cf581003b36c29485fb3e66218f526f1dfc01a7a3aee11c6489d39a9cd5256d065993aa645175e45
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\acmnemahikflikdleabkacdlkbofjpcg\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\acmnemahikflikdleabkacdlkbofjpcg\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\acmnemahikflikdleabkacdlkbofjpcg\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\k2mOMvV4f97l9zT.datFilesize
1KB
MD50a92c834ba51f5574f187436f28dd83b
SHA117a537899503d73ba9532773c7e6d0fd72c4c49b
SHA256d13b93ef4b4007640c15362c0d97df1981e80e2bd51ee669ca729611cfd9b867
SHA512a4aa5e8174ee22742b18243e3aa67d52c3c8d64eaf0307d2b09d14d86c8aee106c356832dfd098406d955baa781a9b561f2e72e1b1edb1f932dc5d768b1358fd
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\k2mOMvV4f97l9zT.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\k2mOMvV4f97l9zT.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\[email protected]\chrome.manifestFilesize
35B
MD53f2b5d181c54ea06a213cd7ea2f7ddae
SHA1102472387f80b82479fba8af062b2a069794f53e
SHA2568149d2b6c5bfeb9862a0160f95f8396b1a68ce48130635f4299d14479bc0e88b
SHA5121fef7c2e5cdf0b3f1dc564feba51b5f7fc0186a00b1042fb3df4bccb637760cff2d89437a4b2e80fa62cc6108671fe4f5fe17e9ca02b1da5412ff8cd300b9e84
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5765f98326ca8bfa5de73d254112dd165
SHA146bd2b7c73d67e787ccc3f6401d59d3163230a98
SHA256493444ec07b44dca29cdd054a7c3461f0a5f0ce154e8a1176f44200b642d36fe
SHA512b2f5d6e4c2984c1a9b9c096dfb9edf43a48b8b2b72ce922a7963f7f817555f41e6a061b482090075b87dceca7c1b4dff7d8dd484750563aa733710ce17696ec4
-
C:\Users\Admin\AppData\Local\Temp\7zS52B4.tmp\[email protected]\install.rdfFilesize
593B
MD5a3231f8e62b247d269653fe1edbf6374
SHA1fe88f7cf0c055d9fc11e6223547274116459d402
SHA25632e6acd6d0d9b60c6af7d68e4f11ee38bfc61bdb81f043d1d86dc06394c0d4a7
SHA51243a2f3bc77df214ca74f93a59463db80e61381bf5502ed61d78c7023618fc1511a16a070eba7e8223a8fa6bd82d093a77aab4ad4804d7c7378bc5577af205e68
-
memory/3264-132-0x0000000000000000-mapping.dmp