Analysis
-
max time kernel
46s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 01:59
Static task
static1
Behavioral task
behavioral1
Sample
490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe
Resource
win7-20220901-en
General
-
Target
490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe
-
Size
931KB
-
MD5
bacb0bd7fb1a627e309815db3f24d1ea
-
SHA1
6181741e39e36b7dd1dde2d515e6413029d9c52b
-
SHA256
490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732
-
SHA512
e65293ee22a02662b6111fd6aa5c3661188ce129853ad847882edcef8be71c62249d459c64f4147c6fffb7524c73dfc4629172648e7531e286548a4fc20ed702
-
SSDEEP
24576:h1OYdaOZCZ/iWCvu/2sWsJA/jlt+DHhs7:h1OsDCpYO/dJJDHhs7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
OY5ng4aSveaCvQi.exepid process 956 OY5ng4aSveaCvQi.exe -
Loads dropped DLL 1 IoCs
Processes:
490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exepid process 960 490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
OY5ng4aSveaCvQi.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfilbcfkhccephgicljilaodlkghgagh\2.0\manifest.json OY5ng4aSveaCvQi.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfilbcfkhccephgicljilaodlkghgagh\2.0\manifest.json OY5ng4aSveaCvQi.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfilbcfkhccephgicljilaodlkghgagh\2.0\manifest.json OY5ng4aSveaCvQi.exe -
Drops file in System32 directory 4 IoCs
Processes:
OY5ng4aSveaCvQi.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol OY5ng4aSveaCvQi.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI OY5ng4aSveaCvQi.exe File opened for modification C:\Windows\System32\GroupPolicy OY5ng4aSveaCvQi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini OY5ng4aSveaCvQi.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
OY5ng4aSveaCvQi.exepid process 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe 956 OY5ng4aSveaCvQi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
OY5ng4aSveaCvQi.exedescription pid process Token: SeDebugPrivilege 956 OY5ng4aSveaCvQi.exe Token: SeDebugPrivilege 956 OY5ng4aSveaCvQi.exe Token: SeDebugPrivilege 956 OY5ng4aSveaCvQi.exe Token: SeDebugPrivilege 956 OY5ng4aSveaCvQi.exe Token: SeDebugPrivilege 956 OY5ng4aSveaCvQi.exe Token: SeDebugPrivilege 956 OY5ng4aSveaCvQi.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exedescription pid process target process PID 960 wrote to memory of 956 960 490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe OY5ng4aSveaCvQi.exe PID 960 wrote to memory of 956 960 490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe OY5ng4aSveaCvQi.exe PID 960 wrote to memory of 956 960 490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe OY5ng4aSveaCvQi.exe PID 960 wrote to memory of 956 960 490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe OY5ng4aSveaCvQi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe"C:\Users\Admin\AppData\Local\Temp\490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\OY5ng4aSveaCvQi.exe.\OY5ng4aSveaCvQi.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\[email protected]\chrome.manifestFilesize
35B
MD533d5c4a6d0583ebc36dc19c195119d0b
SHA107c8a4cb6702d22778003da22f05e68d22b27c76
SHA256ceed9c4a98d96c1cbc18d41cb8a3a3cdd1a5fc2fc4c044b0ca20c9508b993634
SHA5125bd111c1d56bf15f492aa402e7f20d4daf44c4158bdd1d0372067b173c6ed4828ea036cf3eb0e74df21569ffc4b7a1cc6335fbb20e910a15fe59642cb53a5408
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\[email protected]\content\bg.jsFilesize
8KB
MD53140b9dfe7663f31980c519c4c6f98d7
SHA1d718fe06aae42aadf91b6a6c539a979558a343cd
SHA2562f4251401c3136aba4b84eddb878a8608a7ed493e4e20fb9676592061a72952c
SHA5122f6545d1cbab5cdc666847574f50e0d26c6f698fdff5184a54b8a7586cd4f556e59703177c6c47b94819280bc323d414b4e9143734cf77cd23ebac16411bd380
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\[email protected]\install.rdfFilesize
592B
MD561024e743585f453fbe3354738a7dcdb
SHA17312be8f7ed6da012c8f3ee495abcd8f5a641c70
SHA256dceddc51488bab0401bec271373d424ccace662a3d060a8dbbf7168ba3c043d1
SHA512bb6911d4cebcf4af39b758e70149fa41f9224952b547e1a0aeac541c50be92f504dd4e668fe0fe53e1ff744639ed081208f8c7979bd884b03f0f4b017eada1ae
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\OY5ng4aSveaCvQi.datFilesize
1KB
MD50cc0b8a668d7472f3c1ccf73ddffd9fd
SHA1960027e494a73dc028fa154c3e3d1d35141b21d1
SHA256a9ec65b7b28fbee42f5f6aa7d6c67e29c04e68a606940618998e623aa34d8f78
SHA5128818c6e5750436bd069c06c83e34d03d0dbeaf48bde66d61e75149260cd617a3e12fc1a23f4bbfb622b2ff531488be2c1d5605c127e6ce771fd123ba4e997aef
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\OY5ng4aSveaCvQi.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\nfilbcfkhccephgicljilaodlkghgagh\AQNC.jsFilesize
6KB
MD523653be6de57725fa25613b1d3dca65e
SHA1520004e30ab523373d0d5bc5a79547f01c148451
SHA2563d4ad0f684ae299176366d6246e0aee0cef5f6c43eee0b7509aded85d68056fb
SHA51281d0679a24e99ce71b5b8bb96ba40f1c4964a39da99e60aff07dc73e0866d9566270144d0c7ae34db5756cd83bd35de155092b0715730baa1aff6ef311ebae68
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\nfilbcfkhccephgicljilaodlkghgagh\background.htmlFilesize
141B
MD537b3bcfac924df5985c08ed0f378f662
SHA1768cdf7d2bf0778f4941ba2958a47a92f617eeee
SHA25605d17b887b731285476962c0aee456680d3934b1df0a5797b3cc9f890ca37dae
SHA5122f0b96d082aaa4d0af88810708ef35779c78b73013be6a80529b5e0df8a963921938111b2d81a2c63eba302807dddbbafaf28d1a7924830415eb6e7a0846fc66
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\nfilbcfkhccephgicljilaodlkghgagh\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\nfilbcfkhccephgicljilaodlkghgagh\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\nfilbcfkhccephgicljilaodlkghgagh\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zSFA95.tmp\OY5ng4aSveaCvQi.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/956-56-0x0000000000000000-mapping.dmp
-
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB