Analysis
-
max time kernel
151s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 01:55
Static task
static1
Behavioral task
behavioral1
Sample
4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe
Resource
win7-20221111-en
General
-
Target
4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe
-
Size
919KB
-
MD5
f0597d0449c193961e91398c100c7cf5
-
SHA1
e904de58ae4d0de530c2c3be2c37c04c2ee37865
-
SHA256
4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5
-
SHA512
998e280642fa62273580a8f828b0e7dacd8d8919d37b899f81ec520b303d72915bf41299ae6287025b7d96c67c33f7a13a8155ecaddeb30afa22d64d4c324a7c
-
SSDEEP
24576:h1OYdaOuMtdHAqcdDVhYwiei7+EpFAh/kKE:h1OsTPHVmVhYwiLtKkKE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
UOTferVsB0nYA8Y.exepid process 4480 UOTferVsB0nYA8Y.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
UOTferVsB0nYA8Y.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjbbfacpkjmbhhekgdkbfhloilbommci\2.0\manifest.json UOTferVsB0nYA8Y.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjbbfacpkjmbhhekgdkbfhloilbommci\2.0\manifest.json UOTferVsB0nYA8Y.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjbbfacpkjmbhhekgdkbfhloilbommci\2.0\manifest.json UOTferVsB0nYA8Y.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjbbfacpkjmbhhekgdkbfhloilbommci\2.0\manifest.json UOTferVsB0nYA8Y.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjbbfacpkjmbhhekgdkbfhloilbommci\2.0\manifest.json UOTferVsB0nYA8Y.exe -
Drops file in System32 directory 4 IoCs
Processes:
UOTferVsB0nYA8Y.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy UOTferVsB0nYA8Y.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini UOTferVsB0nYA8Y.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol UOTferVsB0nYA8Y.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI UOTferVsB0nYA8Y.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
UOTferVsB0nYA8Y.exepid process 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe 4480 UOTferVsB0nYA8Y.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
UOTferVsB0nYA8Y.exedescription pid process Token: SeDebugPrivilege 4480 UOTferVsB0nYA8Y.exe Token: SeDebugPrivilege 4480 UOTferVsB0nYA8Y.exe Token: SeDebugPrivilege 4480 UOTferVsB0nYA8Y.exe Token: SeDebugPrivilege 4480 UOTferVsB0nYA8Y.exe Token: SeDebugPrivilege 4480 UOTferVsB0nYA8Y.exe Token: SeDebugPrivilege 4480 UOTferVsB0nYA8Y.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exedescription pid process target process PID 1480 wrote to memory of 4480 1480 4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe UOTferVsB0nYA8Y.exe PID 1480 wrote to memory of 4480 1480 4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe UOTferVsB0nYA8Y.exe PID 1480 wrote to memory of 4480 1480 4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe UOTferVsB0nYA8Y.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe"C:\Users\Admin\AppData\Local\Temp\4a4dda4021d5644912cbd3e2b31198b847c29eec9e14b0de6b43eb50b829d9f5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\UOTferVsB0nYA8Y.exe.\UOTferVsB0nYA8Y.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\UOTferVsB0nYA8Y.datFilesize
1KB
MD5852b090c7b9b93184b839bbc02bc8b13
SHA16ee67bea7f46a1a62ce36ac457710279e9eb5f8f
SHA2562f384c6e9c61be74e91b26ba44392166094eefa924a427d9efd129374c427a4d
SHA512852a78893dcfd59c9fda673d39a8def1a5dd0bfee2dd257d2dcbc40dbbc94b5f759bd87a7f1bc4202ab3ddde6f94f7c2aabf1cc938775286db66abb923549c82
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\UOTferVsB0nYA8Y.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\UOTferVsB0nYA8Y.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\[email protected]\chrome.manifestFilesize
35B
MD5c3184ed0bc92d933311b0ca99fe57596
SHA166ea57bb9767821e5ae53820edf71da2b092c4e0
SHA256fabaa6e035b540e50e3e6cd49ef47e8c270691be66255bb23d9fae50a4d2ca89
SHA512b6e32a9bfe12b584974af9a44325f96fb49015095afd2d2162ecfcd1f8df776cd3db273d12d23ea4eb32c0ceb08e1c6b89d0ab6e83816908e2564dabe5ed7336
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\[email protected]\content\bg.jsFilesize
8KB
MD50b48f6bd5b28547b8be222283106c41b
SHA15e49ce4f081bf89b7855ec622f998033f5cb58c5
SHA25661fc5a6d246f9aade528d9022caec0212832b3bdcdf4a88b4436e2ed233f927a
SHA5124c9d09a55e612991cd45d3cec058fe418d7f2b4f923650cbadab6f492994029bc522bda6fc61e48ad753f1f49cd8e3b489ff9ed5038c264dd14d8cf5cc6d53ef
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\[email protected]\install.rdfFilesize
597B
MD53d734f0878dda445f50da7e4deeda308
SHA19bc02c2cd7f84d8d577002e90dbec1d027e0a9aa
SHA2565655ab3a55ab13ef6bcac535780ebbfe772787a7a0a4f8710c7ee52926573261
SHA512285bfe09fbf80b02de3d0888d280dc0e81509385896ed114ae9d41c9819f71aef6848d58cd46cadab90bc726facab26631b87628496f936df98c7a898828901b
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\kjbbfacpkjmbhhekgdkbfhloilbommci\LiyJvJjua.jsFilesize
6KB
MD52d13a38be0d80869d11b3e2349f15ad9
SHA1c83da3ca06f32ed0c1003166cc26453688cd71ae
SHA25680013569db38f4d929bce1c393ce1b698d882211d8f63cc5b415969ffcf9969b
SHA512e9fce9f3f263e31b74482713ddeff267a5bdab0286e2dbd2b19e97b3f7eaefbdba38aa3a60752607ed9cb8bf44e77398a74ae517cab258855dda0bad19955ab0
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\kjbbfacpkjmbhhekgdkbfhloilbommci\background.htmlFilesize
146B
MD56b6d464f61ba1006b61e50f6af7232de
SHA1af8e9abfc20a8c804c9ccdddf1dc6b008a174757
SHA2567fe2da5b82597d83f7a0f0db0e62e83a624ebf3ba14bac896db6117342f23372
SHA512e9e54ef0da46ede641cf08ff6c958ad082fd82f72dfd8340d58b172af1abe96c63d4a1098c98e1bac2887539a55f8d09fb6f9c477da137727341e1d3622c771b
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\kjbbfacpkjmbhhekgdkbfhloilbommci\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\kjbbfacpkjmbhhekgdkbfhloilbommci\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS995.tmp\kjbbfacpkjmbhhekgdkbfhloilbommci\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/4480-132-0x0000000000000000-mapping.dmp