46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718

Analysis

max time kernel
12s
max time network
49s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe
Size

932KB
MD5

6e6523bad35b1d08b1ce209297d3c6e5
SHA1

c13d4741aeff5a43f6b134afbc5d30aeca7b0888
SHA256

46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718
SHA512

3b2eac3391649bef2bfa22a17125f182884c05cd852d47830831441c01f288d86a61150e248508e60590649a5af2b22227e9b200ecdfb87b7bee8224cf40b35c
SSDEEP

24576:h1OYdaO+CZ/iWCvu/2sWsJA/jlt+DHhs9:h1OsECpYO/dJJDHhs9

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

q8TDsoS0pfhn8qn.exe

pid process

2008 q8TDsoS0pfhn8qn.exe
Loads dropped DLL 1 IoCs

Processes:

46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe

pid process

2040 46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2040	46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe

Drops Chrome extension 3 IoCs

Processes:

q8TDsoS0pfhn8qn.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\empjloceeckokkcomfocflijnlhkaoml\2.0\manifest.json	q8TDsoS0pfhn8qn.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\empjloceeckokkcomfocflijnlhkaoml\2.0\manifest.json	q8TDsoS0pfhn8qn.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\empjloceeckokkcomfocflijnlhkaoml\2.0\manifest.json	q8TDsoS0pfhn8qn.exe

Drops file in System32 directory 4 IoCs

Processes:

q8TDsoS0pfhn8qn.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	q8TDsoS0pfhn8qn.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	q8TDsoS0pfhn8qn.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	q8TDsoS0pfhn8qn.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	q8TDsoS0pfhn8qn.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

q8TDsoS0pfhn8qn.exe

pid	process
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe
2008	q8TDsoS0pfhn8qn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

q8TDsoS0pfhn8qn.exe

description	pid	process
Token: SeDebugPrivilege	2008	q8TDsoS0pfhn8qn.exe
Token: SeDebugPrivilege	2008	q8TDsoS0pfhn8qn.exe
Token: SeDebugPrivilege	2008	q8TDsoS0pfhn8qn.exe
Token: SeDebugPrivilege	2008	q8TDsoS0pfhn8qn.exe
Token: SeDebugPrivilege	2008	q8TDsoS0pfhn8qn.exe
Token: SeDebugPrivilege	2008	q8TDsoS0pfhn8qn.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe

description	pid	process	target process
PID 2040 wrote to memory of 2008	2040	46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe	q8TDsoS0pfhn8qn.exe
PID 2040 wrote to memory of 2008	2040	46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe	q8TDsoS0pfhn8qn.exe
PID 2040 wrote to memory of 2008	2040	46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe	q8TDsoS0pfhn8qn.exe
PID 2040 wrote to memory of 2008	2040	46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe	q8TDsoS0pfhn8qn.exe

C:\Users\Admin\AppData\Local\Temp\46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe
"C:\Users\Admin\AppData\Local\Temp\46dcfe90f8a29c5ac30746d83255253fdb6a477feaf266ce4105929381c63718.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\q8TDsoS0pfhn8qn.exe
.\q8TDsoS0pfhn8qn.exe
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\empjloceeckokkcomfocflijnlhkaoml\background.html
Filesize
146B

MD5
c9a4c6e231598cfde3d0cbfdb878d194

SHA1
76222f32493d9ceed4b4d1239570116934d3e026

SHA256
73329bf7629be64d33e33cb6839bb6d3a46b09cebda9cdff67aedc6eff14bfcd

SHA512
1c535ca9920cd4593655d81397b5cb8133f901e864fd0e79194e861ab67f26b9d033e080adf16ccf5136ac7c80d06b79e5d3d162cf960c99fda1af07a1a7fa55

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\empjloceeckokkcomfocflijnlhkaoml\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\empjloceeckokkcomfocflijnlhkaoml\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\empjloceeckokkcomfocflijnlhkaoml\manifest.json
Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\empjloceeckokkcomfocflijnlhkaoml\vaSpjRg81.js
Filesize
6KB

MD5
742fa959debc8504db9f74ab9ff20a9c

SHA1
8435ce4a04eb33edd00f912b6d94795540439a71

SHA256
aaca0428cd5fddf8768628ff9792bf7a0e1cf1b4f2daeb642b4bcc8afca4b56f

SHA512
59ca4c261a20d9f63d1c5c64c7ba7b0a4f13c31205c09ccdb0c11ebe2cc911c619c1cc9d17cadca182082e5feff9d1f56043f8fc21f76cb582bb9aa45b21e2e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
23e474b5174e08d52d7b7b521f98d77d

SHA1
34843825030a56ac7ff57eacd5f54a38c0c0b0fb

SHA256
8d6121e29cbba207965c10c30842311ed0629b12764235c7c4baea0e28ae7fa4

SHA512
a24d5c1f8de8c787370b63812668f2945c4b564300c0266e31c1680bdfce40cdb1647f6bf6f44d163dd02a43912978711f6659f8e932acf5b066a9f814553eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\[email protected]\content\bg.js
Filesize
9KB

MD5
33192a3dd6833392154d2da99342fe48

SHA1
dbd32912815544e50e1ab0c2b65a62772529c138

SHA256
4db3850a63786779aef59f7f838622e64a392b44acb91a653b1afcba66dca1cd

SHA512
005b6fa808db44e1b14f3740132b81d7fdb4bb592a7f88348fed8dd582f0d4c292f7ac6b5dc254ea867477ac1a6d49d548ff95e3609d157d6230c85d703b7449

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\[email protected]\install.rdf
Filesize
595B

MD5
4b5f8f20a7342d4ac070a7965f030672

SHA1
e22d71ea2d6a1fa867225e3a8584bcb93af1d792

SHA256
0d2f22af3cdbddb366c5cee1ef4bff8cb5a0f5c55f09b14119855c7796d1f030

SHA512
d0c065c3287ac465ee94803a73d8c711cb58f20f71e37a59ac5f14a74e1b81e7c6b93f949b1a375282aa1bb503e6a9cfb58e68de8527e0becb6a9df6403bd5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\q8TDsoS0pfhn8qn.dat
Filesize
1KB

MD5
39f7d103eb30e6dd2afbfc05a991dc56

SHA1
1e6db7fdbaa9d22e12a05a3349441e658050640b

SHA256
44f7061e2c738faea56be5c0ee5f9eb4f95b9ff5931a106b70ccd46b3251a41e

SHA512
e7c57fbb6a576db065c4726940d13406578809a3e36bc9be0a9818f450b24915ef7ef9622311a19059e8a3b2b578a3ea468b91a58dd03ea050ef0be34e3a5ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC939.tmp\q8TDsoS0pfhn8qn.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC939.tmp\q8TDsoS0pfhn8qn.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/2008-56-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads