Analysis
-
max time kernel
20s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 02:00
Static task
static1
Behavioral task
behavioral1
Sample
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe
Resource
win7-20221111-en
General
-
Target
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe
-
Size
920KB
-
MD5
9019e0954bdbf51873f80b71e60b2666
-
SHA1
03e9bbb43de4bead7fa9d1f132b152a42b075f7f
-
SHA256
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454
-
SHA512
f646246f1923d133bee1aa827c688413cd561699c377c4633444a135c93aab6da90f5b4746cef9e9c2dc386c4ceb1d2d8e31666f4bc4dd3cdd85e058d0a2def1
-
SSDEEP
24576:h1OYdaOvMtdHAqcdDVhYwiei7+EpFAh/kKh:h1Os6PHVmVhYwiLtKkKh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
1HuxnwnRYEZPgep.exepid process 580 1HuxnwnRYEZPgep.exe -
Loads dropped DLL 1 IoCs
Processes:
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exepid process 864 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
1HuxnwnRYEZPgep.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe -
Drops file in System32 directory 4 IoCs
Processes:
1HuxnwnRYEZPgep.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 1HuxnwnRYEZPgep.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 1HuxnwnRYEZPgep.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 1HuxnwnRYEZPgep.exe File opened for modification C:\Windows\System32\GroupPolicy 1HuxnwnRYEZPgep.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
1HuxnwnRYEZPgep.exepid process 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe 580 1HuxnwnRYEZPgep.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1HuxnwnRYEZPgep.exedescription pid process Token: SeDebugPrivilege 580 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 580 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 580 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 580 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 580 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 580 1HuxnwnRYEZPgep.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exedescription pid process target process PID 864 wrote to memory of 580 864 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe PID 864 wrote to memory of 580 864 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe PID 864 wrote to memory of 580 864 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe PID 864 wrote to memory of 580 864 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe"C:\Users\Admin\AppData\Local\Temp\48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\1HuxnwnRYEZPgep.exe.\1HuxnwnRYEZPgep.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\1HuxnwnRYEZPgep.datFilesize
1KB
MD5fb1f0c0144bb1a50af18e050311e2024
SHA15c639288f28553cba73d43d774f51000b7e8499b
SHA2568b73b9f3736ec43d41292bcba1054ea9d77ea8dd2dcc297d92b49ea097533f2d
SHA5125fbca1971841be7ce0015e436f22b0e864af47b14deff4649008f4ca1ba0ce4ad7e54f3656f28c1cdfbc5c7cea0b018b6b5516b9e0761ecbb25dcfccb18b742b
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\1HuxnwnRYEZPgep.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\[email protected]\chrome.manifestFilesize
35B
MD57b9196020a30526d213c46c555f55d83
SHA139c68e2fc2372ad0549e7614dfb1adfd9304889c
SHA256724c9fa1f998aaed0e01102722ac4eb5c76e0a88e37a3d9022ce94a65465b2fa
SHA512bebcda9aa4349f091ad1d9f93f418ca7b9f4a9abb6aa12363355efe3d3759d676e68bd4181bb40bb07d75c4dab5cad6557c52437bafeb71442d6ad3c53834c25
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\[email protected]\content\bg.jsFilesize
8KB
MD555feec0c1699696f81882fa0e05b817b
SHA16ca10e0f736c4d58d858b698973b3a1108666047
SHA256b627ad6768fd9e37c355cbc01d321ff65b6bad02018f2534fba9f268f73a6ecd
SHA5127fab558eb1051c656fad91a35b502887ec0c3b694cb346ece8c5171ffc846f48f4d09b6d24221c45fd87f0c18df343c6fb30cbb8a902cc74e19f49f15c2f7eec
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\[email protected]\install.rdfFilesize
597B
MD576dec9ae844959ba0558468d03e893ce
SHA1f871b9f4a3892f9b23dc90fc657d495a45a32316
SHA2565ece000bb5c5c6278ea105771948ea560f811a34f30799e2932a1c6b8bdde91c
SHA51216ee68feafe988ba9e3ec41658b346609633554a8c4ef3815b5b665413b64a26b80cc511793a22ecc3e641827dbe2208073fcda68ab9ba7cbcf54e85e5ba749a
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\djnlcnplfnfknkahnojncmgjaacipooe\H.jsFilesize
6KB
MD54d8351a3e8119ab45ef96786b425c9d0
SHA126a8d8fcbb02bc8c55ee92fadc52be02bf3d84a3
SHA256ad87e65c0371f4e242f9650e376513490376f2f1176e2aacdafced0ce890944e
SHA5124c5f7d5ebdeff6e15697b472be0f063de617e80dfc37fa679ff9e1fb537715db8fcbfb02900549342068a054f3a43d2c61cfe204304219c218e31a628d723041
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\djnlcnplfnfknkahnojncmgjaacipooe\background.htmlFilesize
138B
MD56f78a9f8b3159b436ed441ca0fa88fb7
SHA178b91858aceb4c4b345970b7f5375bd9c5cee5e7
SHA256df00d7c896f5836452fe07dd66a17dd46157fdec21d3c8ca886b1a7ba909165e
SHA512f867296bae6366e6328c8bead204c16130aad48e3c8770a99bf994eb85e7d31c748ed6d219c5bbcc8b2619c0721396213dfe82e4c0072938f6135ca91d627d77
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\djnlcnplfnfknkahnojncmgjaacipooe\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\djnlcnplfnfknkahnojncmgjaacipooe\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\djnlcnplfnfknkahnojncmgjaacipooe\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
\Users\Admin\AppData\Local\Temp\7zSAAB2.tmp\1HuxnwnRYEZPgep.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/580-56-0x0000000000000000-mapping.dmp
-
memory/864-54-0x0000000076B51000-0x0000000076B53000-memory.dmpFilesize
8KB