Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 02:00
Static task
static1
Behavioral task
behavioral1
Sample
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe
Resource
win7-20221111-en
General
-
Target
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe
-
Size
920KB
-
MD5
9019e0954bdbf51873f80b71e60b2666
-
SHA1
03e9bbb43de4bead7fa9d1f132b152a42b075f7f
-
SHA256
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454
-
SHA512
f646246f1923d133bee1aa827c688413cd561699c377c4633444a135c93aab6da90f5b4746cef9e9c2dc386c4ceb1d2d8e31666f4bc4dd3cdd85e058d0a2def1
-
SSDEEP
24576:h1OYdaOvMtdHAqcdDVhYwiei7+EpFAh/kKh:h1Os6PHVmVhYwiLtKkKh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
1HuxnwnRYEZPgep.exepid process 1128 1HuxnwnRYEZPgep.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
1HuxnwnRYEZPgep.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\djnlcnplfnfknkahnojncmgjaacipooe\2.0\manifest.json 1HuxnwnRYEZPgep.exe -
Drops file in System32 directory 4 IoCs
Processes:
1HuxnwnRYEZPgep.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 1HuxnwnRYEZPgep.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 1HuxnwnRYEZPgep.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 1HuxnwnRYEZPgep.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 1HuxnwnRYEZPgep.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
1HuxnwnRYEZPgep.exepid process 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe 1128 1HuxnwnRYEZPgep.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1HuxnwnRYEZPgep.exedescription pid process Token: SeDebugPrivilege 1128 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 1128 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 1128 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 1128 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 1128 1HuxnwnRYEZPgep.exe Token: SeDebugPrivilege 1128 1HuxnwnRYEZPgep.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exedescription pid process target process PID 5096 wrote to memory of 1128 5096 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe PID 5096 wrote to memory of 1128 5096 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe PID 5096 wrote to memory of 1128 5096 48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe 1HuxnwnRYEZPgep.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe"C:\Users\Admin\AppData\Local\Temp\48848334b861953960b975b0d306115e69f5e506e27abc1eab8cc499e946d454.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\1HuxnwnRYEZPgep.exe.\1HuxnwnRYEZPgep.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\1HuxnwnRYEZPgep.datFilesize
1KB
MD5fb1f0c0144bb1a50af18e050311e2024
SHA15c639288f28553cba73d43d774f51000b7e8499b
SHA2568b73b9f3736ec43d41292bcba1054ea9d77ea8dd2dcc297d92b49ea097533f2d
SHA5125fbca1971841be7ce0015e436f22b0e864af47b14deff4649008f4ca1ba0ce4ad7e54f3656f28c1cdfbc5c7cea0b018b6b5516b9e0761ecbb25dcfccb18b742b
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\1HuxnwnRYEZPgep.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\1HuxnwnRYEZPgep.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\[email protected]\chrome.manifestFilesize
35B
MD57b9196020a30526d213c46c555f55d83
SHA139c68e2fc2372ad0549e7614dfb1adfd9304889c
SHA256724c9fa1f998aaed0e01102722ac4eb5c76e0a88e37a3d9022ce94a65465b2fa
SHA512bebcda9aa4349f091ad1d9f93f418ca7b9f4a9abb6aa12363355efe3d3759d676e68bd4181bb40bb07d75c4dab5cad6557c52437bafeb71442d6ad3c53834c25
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\[email protected]\content\bg.jsFilesize
8KB
MD555feec0c1699696f81882fa0e05b817b
SHA16ca10e0f736c4d58d858b698973b3a1108666047
SHA256b627ad6768fd9e37c355cbc01d321ff65b6bad02018f2534fba9f268f73a6ecd
SHA5127fab558eb1051c656fad91a35b502887ec0c3b694cb346ece8c5171ffc846f48f4d09b6d24221c45fd87f0c18df343c6fb30cbb8a902cc74e19f49f15c2f7eec
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\[email protected]\install.rdfFilesize
597B
MD576dec9ae844959ba0558468d03e893ce
SHA1f871b9f4a3892f9b23dc90fc657d495a45a32316
SHA2565ece000bb5c5c6278ea105771948ea560f811a34f30799e2932a1c6b8bdde91c
SHA51216ee68feafe988ba9e3ec41658b346609633554a8c4ef3815b5b665413b64a26b80cc511793a22ecc3e641827dbe2208073fcda68ab9ba7cbcf54e85e5ba749a
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\djnlcnplfnfknkahnojncmgjaacipooe\H.jsFilesize
6KB
MD54d8351a3e8119ab45ef96786b425c9d0
SHA126a8d8fcbb02bc8c55ee92fadc52be02bf3d84a3
SHA256ad87e65c0371f4e242f9650e376513490376f2f1176e2aacdafced0ce890944e
SHA5124c5f7d5ebdeff6e15697b472be0f063de617e80dfc37fa679ff9e1fb537715db8fcbfb02900549342068a054f3a43d2c61cfe204304219c218e31a628d723041
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\djnlcnplfnfknkahnojncmgjaacipooe\background.htmlFilesize
138B
MD56f78a9f8b3159b436ed441ca0fa88fb7
SHA178b91858aceb4c4b345970b7f5375bd9c5cee5e7
SHA256df00d7c896f5836452fe07dd66a17dd46157fdec21d3c8ca886b1a7ba909165e
SHA512f867296bae6366e6328c8bead204c16130aad48e3c8770a99bf994eb85e7d31c748ed6d219c5bbcc8b2619c0721396213dfe82e4c0072938f6135ca91d627d77
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\djnlcnplfnfknkahnojncmgjaacipooe\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\djnlcnplfnfknkahnojncmgjaacipooe\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS8736.tmp\djnlcnplfnfknkahnojncmgjaacipooe\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
memory/1128-132-0x0000000000000000-mapping.dmp