Analysis
-
max time kernel
124s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 02:06
Static task
static1
Behavioral task
behavioral1
Sample
4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe
Resource
win7-20220812-en
General
-
Target
4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe
-
Size
932KB
-
MD5
0e4a1b1e1a123341fb85cf25d0a9d17f
-
SHA1
27173f62e4a7007db156864fcff9c217409476ab
-
SHA256
4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79
-
SHA512
67bafd878d0e91be956499b68cab77df2e578999f2203ffc0f5d9602d0cc47c84cdd5c76da2487309daf53ecf00f2beb2ed58f5d02c7314a779eac4e0a092805
-
SSDEEP
24576:h1OYdaOuCZ/iWCvu/2sWsJA/jlt+DHhs6:h1Os8CpYO/dJJDHhs6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
BJoOYoGeoQZjp4A.exepid process 3180 BJoOYoGeoQZjp4A.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
BJoOYoGeoQZjp4A.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlplckmihibicpbpamgfpfpbdbcebfin\2.0\manifest.json BJoOYoGeoQZjp4A.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlplckmihibicpbpamgfpfpbdbcebfin\2.0\manifest.json BJoOYoGeoQZjp4A.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlplckmihibicpbpamgfpfpbdbcebfin\2.0\manifest.json BJoOYoGeoQZjp4A.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlplckmihibicpbpamgfpfpbdbcebfin\2.0\manifest.json BJoOYoGeoQZjp4A.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlplckmihibicpbpamgfpfpbdbcebfin\2.0\manifest.json BJoOYoGeoQZjp4A.exe -
Drops file in System32 directory 4 IoCs
Processes:
BJoOYoGeoQZjp4A.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini BJoOYoGeoQZjp4A.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol BJoOYoGeoQZjp4A.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI BJoOYoGeoQZjp4A.exe File opened for modification C:\Windows\System32\GroupPolicy BJoOYoGeoQZjp4A.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
BJoOYoGeoQZjp4A.exepid process 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe 3180 BJoOYoGeoQZjp4A.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
BJoOYoGeoQZjp4A.exedescription pid process Token: SeDebugPrivilege 3180 BJoOYoGeoQZjp4A.exe Token: SeDebugPrivilege 3180 BJoOYoGeoQZjp4A.exe Token: SeDebugPrivilege 3180 BJoOYoGeoQZjp4A.exe Token: SeDebugPrivilege 3180 BJoOYoGeoQZjp4A.exe Token: SeDebugPrivilege 3180 BJoOYoGeoQZjp4A.exe Token: SeDebugPrivilege 3180 BJoOYoGeoQZjp4A.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exedescription pid process target process PID 3488 wrote to memory of 3180 3488 4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe BJoOYoGeoQZjp4A.exe PID 3488 wrote to memory of 3180 3488 4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe BJoOYoGeoQZjp4A.exe PID 3488 wrote to memory of 3180 3488 4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe BJoOYoGeoQZjp4A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe"C:\Users\Admin\AppData\Local\Temp\4673d7c27478aa2c4dd212d4e4525e08b5b473309af2073c2abbd034fd6dde79.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\BJoOYoGeoQZjp4A.exe.\BJoOYoGeoQZjp4A.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\BJoOYoGeoQZjp4A.datFilesize
1KB
MD59d1b0542c97cea6a5f07354c2a6b7b97
SHA1041a5bad17b2023b22455324579f2b769bb5babf
SHA25680e2115f8ca9eb0c5be0f1cd23777ca4e839c088fd6b57c654d2b5e79ceb1127
SHA5121c31da93b2ffb9da9999a1a9d3ca2d4dac1d37e865482ade5cee7b6b0b740eac44612cee9355ae1426fedf5c42b38f4eec2271791ada0896829c3eba64e0df1d
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\BJoOYoGeoQZjp4A.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\BJoOYoGeoQZjp4A.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\[email protected]\chrome.manifestFilesize
35B
MD50a32d23310837672c2d78b32fef2e851
SHA1507b594e892fd6a7ed5325c1c12f8b398f1a2798
SHA25615f2fa9ad365f51a617f769bf189639aaf822af9c6979c7d5a27f8005803f63a
SHA512194bd48fe09e5500f30118e19cea8dbdbdc43590d50f6c14de37dc3d3fcb7f147f39df2fc14eba7149cfcd36aa89857a54956bd310edef41f1d370cbd0b85d9c
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\[email protected]\content\bg.jsFilesize
9KB
MD5334d82def3dbbff8f93ba902bbaf9088
SHA13852de41274481daeb23b2db82019d460fa0c634
SHA25695129a59902f1e51b70dbdd853f3d43aca114d831bd356ff36af9a38826036ad
SHA512215c5b8ce1e1ca039b73b30da1a26400d1d376fce523da83555e62a0306e42dd3861a52039021056f35979367b2530cfc226ad341dd671d1714ded4cb0d539f6
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\[email protected]\install.rdfFilesize
591B
MD529acd946ad655c4b4ffaf753b5b43201
SHA1ee3d94d7bd34022b6b31d83f1db9eea88ebdbca8
SHA25677243d0e07fb772f8de0d5c40718303b4f9fb885c57f5d3d9ab245da6c93494d
SHA512b0902ba727120e8485f5a505ae31c02cd4fd7db0a9dc88b0a99e2adcb1522cc010ff05b8e49b794fa8d055c446a86dce8d679dc3949daa5d1fa2577e4f7d6d08
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\jlplckmihibicpbpamgfpfpbdbcebfin\background.htmlFilesize
143B
MD542321b7613f636ac4cc29b9f6d49bc17
SHA151f4d3e581946b343ed36bae00d5915861dbaf40
SHA2569862210ae29f8c7934eaf97a86799c30f52be8a07e6ba7d9962e7430e9044d19
SHA512897a7f4702b3de41c5c7c85588e8aec6c4a613797c895435f6fa445269f0310146222546944e1cf0ce0a7def8a858ff872245693250870bcec7f062812c73471
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\jlplckmihibicpbpamgfpfpbdbcebfin\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\jlplckmihibicpbpamgfpfpbdbcebfin\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\jlplckmihibicpbpamgfpfpbdbcebfin\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSBA1D.tmp\jlplckmihibicpbpamgfpfpbdbcebfin\sejEKv.jsFilesize
6KB
MD59bd28a0b7e9140f20a17721ec7a9576b
SHA1a54ef74a547da1bc2ebd75607d89bdeb2010d565
SHA2569e15946ce568f1de8a874f5142f0f98fcf23bf6a9ff68a8b686c840ac62d15dd
SHA512e754ab03b0d82ec69e5576fa08f838b261f82f0e9408ff94ba3934315e527385dfd0f3403983851e21d504010be191ef831c1616537f1804c909ae212ebf69c8
-
memory/3180-132-0x0000000000000000-mapping.dmp