4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a

Analysis

max time kernel
163s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe
Size

931KB
MD5

bbd29a08724439fb35f0157416e5d1be
SHA1

619eb8fce81712d528075c62dd64f398a0a8c1f0
SHA256

4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a
SHA512

9410237ed363a28cdc378be90481336fb168687f0231976b97f658561df42d26c4b4fa5b4195273049dc9d434ee7abcfb58cb89adc1a2dc4e86b38b424664926
SSDEEP

24576:h1OYdaOZCZ/iWCvu/2sWsJA/jlt+DHhsJ:h1OsrCpYO/dJJDHhsJ

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

u1cfTraB0B9TD43.exe

pid process

4752 u1cfTraB0B9TD43.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

u1cfTraB0B9TD43.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmenaoblindbhljhlmhdmgekiggfjnlc\2.0\manifest.json	u1cfTraB0B9TD43.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmenaoblindbhljhlmhdmgekiggfjnlc\2.0\manifest.json	u1cfTraB0B9TD43.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmenaoblindbhljhlmhdmgekiggfjnlc\2.0\manifest.json	u1cfTraB0B9TD43.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmenaoblindbhljhlmhdmgekiggfjnlc\2.0\manifest.json	u1cfTraB0B9TD43.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmenaoblindbhljhlmhdmgekiggfjnlc\2.0\manifest.json	u1cfTraB0B9TD43.exe

Drops file in System32 directory 4 IoCs

Processes:

u1cfTraB0B9TD43.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	u1cfTraB0B9TD43.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	u1cfTraB0B9TD43.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	u1cfTraB0B9TD43.exe
File opened for modification	C:\Windows\System32\GroupPolicy	u1cfTraB0B9TD43.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

u1cfTraB0B9TD43.exe

pid	process
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe
4752	u1cfTraB0B9TD43.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

u1cfTraB0B9TD43.exe

description	pid	process
Token: SeDebugPrivilege	4752	u1cfTraB0B9TD43.exe
Token: SeDebugPrivilege	4752	u1cfTraB0B9TD43.exe
Token: SeDebugPrivilege	4752	u1cfTraB0B9TD43.exe
Token: SeDebugPrivilege	4752	u1cfTraB0B9TD43.exe
Token: SeDebugPrivilege	4752	u1cfTraB0B9TD43.exe
Token: SeDebugPrivilege	4752	u1cfTraB0B9TD43.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe

description	pid	process	target process
PID 3628 wrote to memory of 4752	3628	4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe	u1cfTraB0B9TD43.exe
PID 3628 wrote to memory of 4752	3628	4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe	u1cfTraB0B9TD43.exe
PID 3628 wrote to memory of 4752	3628	4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe	u1cfTraB0B9TD43.exe

C:\Users\Admin\AppData\Local\Temp\4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe
"C:\Users\Admin\AppData\Local\Temp\4a2db9976834cb4f8c0cfdd5c1333a7c3d161200cdfe6a0aec97c9beb6888d3a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\u1cfTraB0B9TD43.exe
.\u1cfTraB0B9TD43.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
d7b3a1a9e76675179c0afbbc42b19005

SHA1
8a80b59c93bc28edf7ec7a430230cb55501e5de9

SHA256
a509f67bfb38de75aaf6c0d3afc326aadea0129ba4bab7f0af9dbc5dc5e6ffb1

SHA512
af0f8c9bbd908173c941f32660fb0d6b4bc0ad54d557f587c0ec8819bf7d8ac02575a73dbe132082309014c2a8b05f0c6ae49599cf6fe587d6fdc653744e5d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
720d6d55efd55d930ff4847b7af4cef4

SHA1
4bf34aef7d7547bd8df3d5c6c95e4cfe92757b96

SHA256
368a9b53036c8a7df03e088f4261beeb5338740b875fc474c35c63eb2a13070a

SHA512
a4d29cfe6f9982c1a01e86806708889cf99e57f4279cb13d097f208f0949d8a7621a582fa9dd2852bc0ce33d763c92a721f713b30dec708d6b9a23f462c86025

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\[email protected]\install.rdf
Filesize
592B

MD5
5381f41f0b42967db0383607e5e7737f

SHA1
67b5d004f82aecf3ddacbe68d1183ba23f5d9f6b

SHA256
b0267efebfebc54ad5431114b90b847477efaf6f1de99893d1f02e3c464c975a

SHA512
281a86ff7d95f14da8069d41b2ff6c4982a84a9078e425c430f367b699833b062f7656b6acc4d7f57859a0cbff3ac76c335a0299f552d0c74774f9bc5b910f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\lmenaoblindbhljhlmhdmgekiggfjnlc\LvFNy.js
Filesize
6KB

MD5
a973459fd12d326f0398436b941f192d

SHA1
723917ac144bc93a475cca467dfa89747c09279a

SHA256
959e956bbde84260c71244559fe81cb39e4179f860923ee102f00b0d7dbf6c6f

SHA512
950c0afe494fda815a8fb5c71460b2a64c88d1d1eb775ad90e6fc382bc53dcc735b20f0c3a4f0f532a0ddf5112495a6d366150fd43f393bd0aceafe67f9709bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\lmenaoblindbhljhlmhdmgekiggfjnlc\background.html
Filesize
142B

MD5
272c4086b76bd3c06d2449a0d0680e95

SHA1
1668b0ed3098ba52ad33d566e92693ace9a49f5f

SHA256
90dda1c03f3c6538138120e3b353b1aa00f5aa588948024ee1cbcb03f36e498f

SHA512
cc034dd9b4adf3c50c8b1468a321812ddd438717e1d5b139b2a50306ea398e61c7606c9427feeb6186a023e4aa21943ea465b84c3f09937154648a9c92c7a534

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\lmenaoblindbhljhlmhdmgekiggfjnlc\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\lmenaoblindbhljhlmhdmgekiggfjnlc\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\lmenaoblindbhljhlmhdmgekiggfjnlc\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\u1cfTraB0B9TD43.dat
Filesize
1KB

MD5
20022f595cde774a0c484fe4a2562aef

SHA1
0f5d5b0a39834bb102da8f23c4d8b066ccab5e39

SHA256
d586a4912738976268497cd994ee7f4b7f5662f1f72945c8599569f7b7c597b3

SHA512
0627640765960294347001ddd839718955beea83d0eddd522b357f774b70158ef978a2ea858cba166e5fd3365406410f4b23dd365f46431e0d390795220f8d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\u1cfTraB0B9TD43.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB81A.tmp\u1cfTraB0B9TD43.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/4752-132-0x0000000000000000-mapping.dmp

Download