Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 01:58
Static task
static1
Behavioral task
behavioral1
Sample
49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe
Resource
win7-20220812-en
General
-
Target
49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe
-
Size
932KB
-
MD5
9dd656dd0a4e87108efd3b417aa41ebe
-
SHA1
4c1141974a7c00873e9b0e90b43b5a7802b24606
-
SHA256
49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a
-
SHA512
4e22431bc79198d2bb4dfda870a08def1670d56924207278d04a190d524e8d0f73b766a880a22e62258c8d1d4f4b28addd04cd497321ee134e3031048b900743
-
SSDEEP
24576:h1OYdaOqCZ/iWCvu/2sWsJA/jlt+DHhs/:h1Os4CpYO/dJJDHhs/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
kUHQpOjKvJ0kZ3a.exepid process 2508 kUHQpOjKvJ0kZ3a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
kUHQpOjKvJ0kZ3a.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjmanofabhkpmhdopjebmlmmcjddokg\2.0\manifest.json kUHQpOjKvJ0kZ3a.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjmanofabhkpmhdopjebmlmmcjddokg\2.0\manifest.json kUHQpOjKvJ0kZ3a.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjmanofabhkpmhdopjebmlmmcjddokg\2.0\manifest.json kUHQpOjKvJ0kZ3a.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjmanofabhkpmhdopjebmlmmcjddokg\2.0\manifest.json kUHQpOjKvJ0kZ3a.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjmanofabhkpmhdopjebmlmmcjddokg\2.0\manifest.json kUHQpOjKvJ0kZ3a.exe -
Drops file in System32 directory 4 IoCs
Processes:
kUHQpOjKvJ0kZ3a.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy kUHQpOjKvJ0kZ3a.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini kUHQpOjKvJ0kZ3a.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol kUHQpOjKvJ0kZ3a.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI kUHQpOjKvJ0kZ3a.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
kUHQpOjKvJ0kZ3a.exepid process 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe 2508 kUHQpOjKvJ0kZ3a.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
kUHQpOjKvJ0kZ3a.exedescription pid process Token: SeDebugPrivilege 2508 kUHQpOjKvJ0kZ3a.exe Token: SeDebugPrivilege 2508 kUHQpOjKvJ0kZ3a.exe Token: SeDebugPrivilege 2508 kUHQpOjKvJ0kZ3a.exe Token: SeDebugPrivilege 2508 kUHQpOjKvJ0kZ3a.exe Token: SeDebugPrivilege 2508 kUHQpOjKvJ0kZ3a.exe Token: SeDebugPrivilege 2508 kUHQpOjKvJ0kZ3a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exedescription pid process target process PID 1932 wrote to memory of 2508 1932 49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe kUHQpOjKvJ0kZ3a.exe PID 1932 wrote to memory of 2508 1932 49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe kUHQpOjKvJ0kZ3a.exe PID 1932 wrote to memory of 2508 1932 49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe kUHQpOjKvJ0kZ3a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe"C:\Users\Admin\AppData\Local\Temp\49699e08d0d0ad9cba4dd8b26101031370b90712851d2fcbc006119760b9577a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\kUHQpOjKvJ0kZ3a.exe.\kUHQpOjKvJ0kZ3a.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\cbjmanofabhkpmhdopjebmlmmcjddokg\background.htmlFilesize
146B
MD58433e7e931d76153b2b6a95283be3b0b
SHA1a5482b1365cb6ab49710780884a4ad3a2693e9e7
SHA2569b7b82eece45cf951ba8f12af2c8825c6aa86045eedad07f4fdcf824ef54151a
SHA51239beb1974be37e57a90e1c3cc7294859cefa8ef80d69db63306f1267075e1cbf9d282b8803102845f49a9a34aba8ec60ad8db77b4bf6c61ea8f701915488c450
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\cbjmanofabhkpmhdopjebmlmmcjddokg\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\cbjmanofabhkpmhdopjebmlmmcjddokg\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\cbjmanofabhkpmhdopjebmlmmcjddokg\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\cbjmanofabhkpmhdopjebmlmmcjddokg\n5ro9f1tO.jsFilesize
6KB
MD5990688700644b234343937c1df1df8f5
SHA1caedac85cbc800ae16d939cb4de0fabb1ade80bd
SHA256e652af743e67aff5b976f7cc91961d24134addc138e4a4037abf44a13c0cec21
SHA51216634755e3906fcfa5baad8fb131160b47d8393ceceb10d1012a4c6e2a14b8ab5532f07687dbc7fe7945e03c5df6377f185c8e01fbcaedb03d460ddd414b3bb0
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\kUHQpOjKvJ0kZ3a.datFilesize
1KB
MD53ddccd6a48f26108f4e9cae25adb5262
SHA1796374538a28321e75e073b953d90f4275a39738
SHA2565257517ac2524197c933397bdb6f7b4b7610c4231148348955921fe3931f4ebf
SHA512446c7df584acbe9e1ad7af4295e90b718ad54a81d991499c5af7eed7788b83c4a2648546f87d7474f27a4a2a35fc6e9c2c51bd4a2f66bbbeac294e39d86f1056
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\kUHQpOjKvJ0kZ3a.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\kUHQpOjKvJ0kZ3a.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\[email protected]\chrome.manifestFilesize
35B
MD5a4f2ce463418ca93bc53928731b626c6
SHA1a4012082c902ebf87f2dd964500996e66bdc0402
SHA256e8cae8c57bdb8b7e1121786c5cf6e781b879824e3ec2078a7a9fc75a2d92c969
SHA512159da3e449a69848ca10866cf98180df2bee4530417940733105fab03e057c328513eb586bea75f141200da2b0a5801f78001ec1d147880e5b4d50f8ffd6f677
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\[email protected]\content\bg.jsFilesize
9KB
MD5b2a695ecfff4a4721358dbbfc5809871
SHA16bf633591b7843c5f884dc338893872259cc5571
SHA256da516d52965ce02d6d1b87702a871a6ddf5e3f6d509389fb094e902b810a8224
SHA512a19269ddc2b05abe8bb7e742a485ee87e1cb0fd4cc9501f591a2d4c16f3be390f729fb38be08faee2de4e0bf4b92d6bfa7d76f851b3ae546d77f0fc534abbcce
-
C:\Users\Admin\AppData\Local\Temp\7zS8B8B.tmp\[email protected]\install.rdfFilesize
596B
MD5e975d458fe07d16a271d2c73359728c4
SHA16c554dfb0b39c2507e9255737534a2411f03d8d3
SHA25665cffcfc19e5c88492df5ffbfdc4409662f05e5e8ea2ce816ed876cdff0b4abf
SHA512e4c3bd6416881143a715bd89ea27042e50c9e2ad79e3cb5bbfc68b26e73d59c1d919c52b2c291206b0db3ddfe469da451a17b5a0b07dac8e5c843ab87c7b8d2c
-
memory/2508-132-0x0000000000000000-mapping.dmp