499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc

Analysis

max time kernel
213s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe
Size

932KB
MD5

97eddc92de2fc6dff81d02124c9f06c4
SHA1

5f95d97df41a4d57fa50a2ee8df180d15f237c19
SHA256

499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc
SHA512

2545958ed771c304da9ae1170226529737d3473f5bd2981dbef8fe1b3f3048e64279cf9101be73ac97e14e40091932ee16d06220be55b78911b6146eb464c90e
SSDEEP

24576:h1OYdaOBCZ/iWCvu/2sWsJA/jlt+DHhsx:h1Os3CpYO/dJJDHhsx

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

X4nTlz9UjKfVAfj.exe

pid process

2352 X4nTlz9UjKfVAfj.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

X4nTlz9UjKfVAfj.exe

description	ioc	process
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdkpojegllegjkofojnfobkoipbpkin\2.0\manifest.json	X4nTlz9UjKfVAfj.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdkpojegllegjkofojnfobkoipbpkin\2.0\manifest.json	X4nTlz9UjKfVAfj.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdkpojegllegjkofojnfobkoipbpkin\2.0\manifest.json	X4nTlz9UjKfVAfj.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdkpojegllegjkofojnfobkoipbpkin\2.0\manifest.json	X4nTlz9UjKfVAfj.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdkpojegllegjkofojnfobkoipbpkin\2.0\manifest.json	X4nTlz9UjKfVAfj.exe

Drops file in System32 directory 4 IoCs

Processes:

X4nTlz9UjKfVAfj.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	X4nTlz9UjKfVAfj.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	X4nTlz9UjKfVAfj.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	X4nTlz9UjKfVAfj.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	X4nTlz9UjKfVAfj.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

X4nTlz9UjKfVAfj.exe

pid	process
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe
2352	X4nTlz9UjKfVAfj.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

X4nTlz9UjKfVAfj.exe

description	pid	process
Token: SeDebugPrivilege	2352	X4nTlz9UjKfVAfj.exe
Token: SeDebugPrivilege	2352	X4nTlz9UjKfVAfj.exe
Token: SeDebugPrivilege	2352	X4nTlz9UjKfVAfj.exe
Token: SeDebugPrivilege	2352	X4nTlz9UjKfVAfj.exe
Token: SeDebugPrivilege	2352	X4nTlz9UjKfVAfj.exe
Token: SeDebugPrivilege	2352	X4nTlz9UjKfVAfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe

description	pid	process	target process
PID 3516 wrote to memory of 2352	3516	499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe	X4nTlz9UjKfVAfj.exe
PID 3516 wrote to memory of 2352	3516	499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe	X4nTlz9UjKfVAfj.exe
PID 3516 wrote to memory of 2352	3516	499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe	X4nTlz9UjKfVAfj.exe

C:\Users\Admin\AppData\Local\Temp\499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe
"C:\Users\Admin\AppData\Local\Temp\499e530c95a777caff481f14cb136994a68f2739e18dd4ab6128964cdac635fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\X4nTlz9UjKfVAfj.exe
.\X4nTlz9UjKfVAfj.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\X4nTlz9UjKfVAfj.dat
Filesize
1KB

MD5
ac157271e222778a3406799db353d976

SHA1
f92a88dd5474de7776d4cba14bb7c5f1695aa07b

SHA256
7859b2a6eb9872eb96dcf5a8bb7da72caedd609521f48763f2071db98455eebb

SHA512
3cf8a61283a893d52923ac38ea4b2c94066d1cefe831fb2903e60ef15030a800d9c0793f2f37c5387abaa62903372d15a5eb966d6f91589fc82fb48205e39c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\X4nTlz9UjKfVAfj.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\X4nTlz9UjKfVAfj.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\lgdkpojegllegjkofojnfobkoipbpkin\A4FzrrmVD.js
Filesize
6KB

MD5
96f6c6a4d02c11fac1352177bf40490b

SHA1
11d9649f59c5b96cb64f19513b75d0e8b4a41344

SHA256
7d152653c576d1c8552dc55f4ca214ee2eef9b86000a78f592a130b00fbc16c9

SHA512
9223d99905a7864285e4ebe3a08d3dddb0418751b5c4d9ccf981ffb266a65e2194c41b4e2c23c12ddd091d2d417641dd92b3fb8350574241d41767cc6d496273

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\lgdkpojegllegjkofojnfobkoipbpkin\background.html
Filesize
146B

MD5
cbc90e597bae8cf06c7f0fb594af57f4

SHA1
c7794a0f85e6ddf08ac60b1ec22370e686a177bd

SHA256
6f5b89a1fcfe6391b50095e4aaf3972e9d3a931a48ffd244975281fd33e893d1

SHA512
797e50ea5e2e65121094b4e7f85d1918a4fd75fcf9166fbda4f0cbeb8cb4ab889cd6fac868e3a4a0736af8af9a0399c60ae013a19263682e4fb706b7bbaad4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\lgdkpojegllegjkofojnfobkoipbpkin\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\lgdkpojegllegjkofojnfobkoipbpkin\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\lgdkpojegllegjkofojnfobkoipbpkin\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
1cc2cf255d34d81ea5d3e9b699ab2248

SHA1
98cba2a1d812cfd2bf27e32fbe4a35ad3d37b3d9

SHA256
70d30df7d138e346323775900c3127f4e48d460c768e5ed933da69a692c60aaa

SHA512
4e406b05eb556dc81255fc2af7386962c3795ce62e24243bf3ce0d79fb5b5d5a482c4b1c2edf5f58c2de4b2fa046a6dc03a58bbaa8d334bbd3bda8ca4365b5ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
7faec9ebc6fb2802b0fc15e9b8fd537c

SHA1
1f6160f7d23aaf5eb1fd74e12a45207b6ed00e2e

SHA256
11bb2c3f0e38fd037e9b7799ca110486775c4457b51c7c3e5efb1dd40e747678

SHA512
edad04d0b65926bf488eff145a9ac5ce4a6c08682d06187d3e1cd397103a66112fcb3eff5ccf4125fc4c88b89360c8c8252aaa12604d1db3994f1864e0d78e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSB7D6.tmp\[email protected]\install.rdf
Filesize
594B

MD5
5f709afb86e113118a90c1038ccf4327

SHA1
58bd01117a8f57ece7e39e1c1416df8a705f409e

SHA256
14744a9403c500ecdbd9d30b5002654131049257ac80ef86ac3c05e14f34174e

SHA512
ab1314ba289ce61b4ef056203a02493b1cd2b0f6495e190b5954352115fd58b493533066b1b665d8314c7f055041889981ef0ed75193d88fa198699aff93c900

Download Submit
memory/2352-132-0x0000000000000000-mapping.dmp

Download