Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 01:55
Static task
static1
Behavioral task
behavioral1
Sample
4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe
Resource
win7-20220901-en
General
-
Target
4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe
-
Size
919KB
-
MD5
c10c1a211ed0fcb10534237a49c7824b
-
SHA1
84b93f2c7092de6059cfea3d69e406c7fdaf6e61
-
SHA256
4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23
-
SHA512
a368bc213ac9ac867da974ab4f5af451f637382c0e301720c122602bbfa3ee227e075e5639f0d4a4dbc42c659d3cff61bbe56087961a159b080d9879fe03e576
-
SSDEEP
24576:h1OYdaO0MtdHAqcdDVhYwiei7+EpFAh/kKx:h1OsJPHVmVhYwiLtKkKx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WUyCL9vqg2NU556.exepid process 1936 WUyCL9vqg2NU556.exe -
Loads dropped DLL 1 IoCs
Processes:
4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exepid process 1500 4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
WUyCL9vqg2NU556.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\akchdjfkllklakmbcjfihoejabpemjee\2.0\manifest.json WUyCL9vqg2NU556.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\akchdjfkllklakmbcjfihoejabpemjee\2.0\manifest.json WUyCL9vqg2NU556.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\akchdjfkllklakmbcjfihoejabpemjee\2.0\manifest.json WUyCL9vqg2NU556.exe -
Drops file in System32 directory 4 IoCs
Processes:
WUyCL9vqg2NU556.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy WUyCL9vqg2NU556.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini WUyCL9vqg2NU556.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol WUyCL9vqg2NU556.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI WUyCL9vqg2NU556.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
WUyCL9vqg2NU556.exepid process 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe 1936 WUyCL9vqg2NU556.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
WUyCL9vqg2NU556.exedescription pid process Token: SeDebugPrivilege 1936 WUyCL9vqg2NU556.exe Token: SeDebugPrivilege 1936 WUyCL9vqg2NU556.exe Token: SeDebugPrivilege 1936 WUyCL9vqg2NU556.exe Token: SeDebugPrivilege 1936 WUyCL9vqg2NU556.exe Token: SeDebugPrivilege 1936 WUyCL9vqg2NU556.exe Token: SeDebugPrivilege 1936 WUyCL9vqg2NU556.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exedescription pid process target process PID 1500 wrote to memory of 1936 1500 4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe WUyCL9vqg2NU556.exe PID 1500 wrote to memory of 1936 1500 4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe WUyCL9vqg2NU556.exe PID 1500 wrote to memory of 1936 1500 4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe WUyCL9vqg2NU556.exe PID 1500 wrote to memory of 1936 1500 4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe WUyCL9vqg2NU556.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe"C:\Users\Admin\AppData\Local\Temp\4a389422afb990689e3c0b7dc1669f569ed4c85bcad2f37905fe3efe62950b23.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\WUyCL9vqg2NU556.exe.\WUyCL9vqg2NU556.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\WUyCL9vqg2NU556.datFilesize
1KB
MD52c9be658fd1abed8378ec908f2003534
SHA1f5cdd33c8d2d016a0acf1bff7a59d87150cad83e
SHA25636e059e898596133420632547edd87b569bc8b2a4e33a195da7217c0e1841eec
SHA512d99e31e6e200cdef10235ea20dff5daeea90f72fe28133d427ee310d6375a51f1676df908393f8634be0042bdc53b8d5372f62b2643fa01722cd9cd2c0604526
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\WUyCL9vqg2NU556.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\akchdjfkllklakmbcjfihoejabpemjee\background.htmlFilesize
142B
MD5a2f6713bb0bd3917ff22683dd62c828f
SHA1c1f6fc868f045a419b5b65d24b4f30acf6b14937
SHA2568301e711ba61cdfc91465f12a066974a789cc75b97bde80451bfc8090110c55d
SHA51211af5080769358e645b4f706b7b7239c118d0bbbb1ce630fd35bfde150a67f7f14a4a52ae8bd6910cc1807855314164bcfa0b228e0200b1dccb25ab6d8644822
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\akchdjfkllklakmbcjfihoejabpemjee\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\akchdjfkllklakmbcjfihoejabpemjee\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\akchdjfkllklakmbcjfihoejabpemjee\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\akchdjfkllklakmbcjfihoejabpemjee\xP02e.jsFilesize
6KB
MD5c5c47299899e35e32f7598477a4a3f7f
SHA158999e6f90e96dfbeb9adf90d2fb785a6e9efac5
SHA25609cc13db4b807a330e2642d039fdd38f91b4654ea243ac19290ec1e55e7bf595
SHA51281f0eecde3380aab117a2b3a62eeca3f3fbcb02a8a94605bfe737670f159f45fef7690dee8164580ddba3ff7bfde43c541ce8b2fc30a72bb37f27e8f3bdb073c
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\[email protected]\chrome.manifestFilesize
35B
MD56f4072d03a07dd1ca35f48e9e1007d59
SHA10ca3367a90f70904a5d8ba487ec0d4e8079e5a84
SHA256fbb3e0c23d777aeaacf583b14b79455bdb11deced97bf465bc26193e0e6ca2ae
SHA512a6ee80ea4bf70815cf2550819e24e470c18ada62f5f971e06e6aca472e8357f00129d083ab701360654d8eb39afb084a39e93d8d6c98d59665bd8b19ce819e4c
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\[email protected]\content\bg.jsFilesize
8KB
MD532717ab8fa99f7e39cc7c02edd5bf9ef
SHA1c89d0e5656c305881757e972ac548b849e3e9a8b
SHA256ef9651ff42c808bc1a70993a11a834b69c02fe3f4121b1293d91b51db44b5f3b
SHA512d428fafdfd813812c7ca41e0c0992b8088c0042963383150187e6084cd273b83fd664fa79c033307c495e34bb0e8265d5d1f5410b63c2c2c4d2227aa99a03dfd
-
C:\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\[email protected]\install.rdfFilesize
591B
MD556ddaf5a897ec6d9af5e0b3dc402dd08
SHA1bda38b5639fa5bd4cf50af049dbee16b93be2eb3
SHA256ffc52ea7d805346ec3b766efffa7bb4ee740e14a700b9795ef88c4f3f34755fa
SHA51205a56762b7bb9a63cd2bf7d39ccc422ff7b44fc0dcf886bdd811bc940dfd0acf01f7d527c3e4a039e3586a0564d64d42d8e029a0a5500031de6bdd67d9dd2775
-
\Users\Admin\AppData\Local\Temp\7zSFA57.tmp\WUyCL9vqg2NU556.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1500-54-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1936-56-0x0000000000000000-mapping.dmp