Analysis
-
max time kernel
4s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 01:55
Static task
static1
Behavioral task
behavioral1
Sample
4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe
Resource
win7-20221111-en
General
-
Target
4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe
-
Size
931KB
-
MD5
d3c5681e1c70c15c2a73d2b7078a4e64
-
SHA1
e8100716e4755d80018fa0899f7468e916a29860
-
SHA256
4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301
-
SHA512
d33d44e7a736b3d657d8383c967e17f7349f8abe74201b052a44bb4a41ab26563f7095a1f7e3c578a39f9b8e464f3e766a0ab848dc76a2d1bde936681f894454
-
SSDEEP
24576:h1OYdaO/CZ/iWCvu/2sWsJA/jlt+DHhsZ:h1OsJCpYO/dJJDHhsZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DF23YETjSh6CCUl.exepid process 1120 DF23YETjSh6CCUl.exe -
Loads dropped DLL 1 IoCs
Processes:
4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exepid process 1348 4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
DF23YETjSh6CCUl.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\maigmpboklacbmnmjbjfbnelacbgljdo\2.0\manifest.json DF23YETjSh6CCUl.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\maigmpboklacbmnmjbjfbnelacbgljdo\2.0\manifest.json DF23YETjSh6CCUl.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\maigmpboklacbmnmjbjfbnelacbgljdo\2.0\manifest.json DF23YETjSh6CCUl.exe -
Drops file in System32 directory 4 IoCs
Processes:
DF23YETjSh6CCUl.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy DF23YETjSh6CCUl.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini DF23YETjSh6CCUl.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol DF23YETjSh6CCUl.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI DF23YETjSh6CCUl.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
DF23YETjSh6CCUl.exepid process 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe 1120 DF23YETjSh6CCUl.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
DF23YETjSh6CCUl.exedescription pid process Token: SeDebugPrivilege 1120 DF23YETjSh6CCUl.exe Token: SeDebugPrivilege 1120 DF23YETjSh6CCUl.exe Token: SeDebugPrivilege 1120 DF23YETjSh6CCUl.exe Token: SeDebugPrivilege 1120 DF23YETjSh6CCUl.exe Token: SeDebugPrivilege 1120 DF23YETjSh6CCUl.exe Token: SeDebugPrivilege 1120 DF23YETjSh6CCUl.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exedescription pid process target process PID 1348 wrote to memory of 1120 1348 4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe DF23YETjSh6CCUl.exe PID 1348 wrote to memory of 1120 1348 4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe DF23YETjSh6CCUl.exe PID 1348 wrote to memory of 1120 1348 4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe DF23YETjSh6CCUl.exe PID 1348 wrote to memory of 1120 1348 4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe DF23YETjSh6CCUl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe"C:\Users\Admin\AppData\Local\Temp\4a6c3ed3e0a777cfe46672a6414c53cc268b8de894404179cc488e4988a3c301.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\DF23YETjSh6CCUl.exe.\DF23YETjSh6CCUl.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\DF23YETjSh6CCUl.datFilesize
1KB
MD5c89e3fe217dc0d3de65cb1af22ff7eea
SHA1e12d4499becf2006538a50f27dbc97ca974045d1
SHA256fc4ca4f0c7449432f748dc16902d16c2c1dfa03098ba5e9b76aa2509d227da6c
SHA51219d27a11c54649176fcd9aa385b4fadebf336ee6db7691e74f90207183c34a12b8568a5caf1f32fca5421126bbefc54b03b249f4d2a9c935f7bd458efc372183
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\DF23YETjSh6CCUl.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\[email protected]\chrome.manifestFilesize
35B
MD57a0c8c76e44a62272f7278cc721dca57
SHA1f97c8b49fc6d2d714aa265ffa6893b4aa5a703a6
SHA256752f3491c4a845c4c5db657a6dc254a618a921daf7c5f6f72b813ddb053a953e
SHA512548d5432b51bcb10c192980a55e7cc9536f467463265b60ff68e5ff19efe95c2d06633a54e0fca46c4b29732db9dcb65a774e99aa8309a740cd08265927f9ffd
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5b874fad5b6ba9ffb0461477b6ac598e6
SHA1e13f25610aefa0cb816d38a21d1577251480f620
SHA2569255d8eaadb74704a25b572bdceb01fce0bb3e8a6717541d1b7e3f059bef9745
SHA5126f1b137d47f364ee8255e81bee7405d85ea2f7dd209a7b25c906e76ea9447696e30f0de8b06b2a8b0d98181f507e210555cfc44b9015138fd52fcd66b364b36c
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\[email protected]\install.rdfFilesize
596B
MD529d212bcb55d6ca847033a0120bfe4dd
SHA1e258939eb23c94fbdfb4f2964a8c442c887a58df
SHA256ee96dccfffeaa5c02058d4b9be6a96ac99b254d52420458d0a6a5e49b0bdbb97
SHA51250e01f03b60d39833efe37525dd9bd2d6963295cdc19904b75b9779d0531b57e952531eb407a6e0152e263c24485a7f62874ef41766b1dce54a38bda37013d44
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\maigmpboklacbmnmjbjfbnelacbgljdo\U.jsFilesize
6KB
MD52f47edc7b533624b9728058be5bed50b
SHA120724e5fbea5ffe6e45668f13f94dce0697d1c10
SHA256034dd0bffe62e955b7d24058b66b4ae1eae830ce5ffd7662f74f028051f71e32
SHA512c7f70dd94d12dfc4ae9d41c74f89c442ac64fe6364ba78191c70154906fe91a06beee69aa2381ffba234c8d2ff5793993bbf877a92b979df55a78099ca952f1c
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\maigmpboklacbmnmjbjfbnelacbgljdo\background.htmlFilesize
138B
MD5e1b4deb0e527b3cf57477d89855bea06
SHA1d815c8fb55038db446043b8590737a40a7f3d809
SHA2564250433b6b4d17673c63d7b850d0eb440fe4a6ad00baa41ca0fd1481e92d0a23
SHA512bb06bd5b56ada66f1f93ae154e4375762cf878acafd327bea99e41d492ccedd1a7b79262bac54bbcc52494d1625de7fd74babeb495f2b74252e3831f4e1b7c90
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\maigmpboklacbmnmjbjfbnelacbgljdo\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\maigmpboklacbmnmjbjfbnelacbgljdo\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSA738.tmp\maigmpboklacbmnmjbjfbnelacbgljdo\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zSA738.tmp\DF23YETjSh6CCUl.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/1120-56-0x0000000000000000-mapping.dmp
-
memory/1348-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB