Analysis

  • max time kernel
    173s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 07:23

General

  • Target

    9a8272140cdbcbde1fafe9b38b4b2b3c0e94aac5eab80f7b9f0eed1d263cbc7e.exe

  • Size

    3.7MB

  • MD5

    117279679a84ec7b074b2c7aed921f73

  • SHA1

    c0f8b318babf1da3f84920369556b2bb1dd9eda0

  • SHA256

    9a8272140cdbcbde1fafe9b38b4b2b3c0e94aac5eab80f7b9f0eed1d263cbc7e

  • SHA512

    3ac79f5f4c872b611615d6bf60a82d3df4dd1bbeb40d03e16bca6bd3d35cc1b035ff3939dc8b84ec580b3e121a41232fbb5c17ad1261cfe362838dc8b0426d6e

  • SSDEEP

    98304:J02y3CWtlHf9FSCSSCw8Rcs2aRrFLPnHxptQEf9LOoY:Jk/SlRO

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a8272140cdbcbde1fafe9b38b4b2b3c0e94aac5eab80f7b9f0eed1d263cbc7e.exe
    "C:\Users\Admin\AppData\Local\Temp\9a8272140cdbcbde1fafe9b38b4b2b3c0e94aac5eab80f7b9f0eed1d263cbc7e.exe"
    1⤵
    • Loads dropped DLL
    • Drops Chrome extension
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4284
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2508
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:5072
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:4820

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.dat
        Filesize

        5KB

        MD5

        208d11bcde390a3e665ac64b779679ac

        SHA1

        b0bce314988c5e7d71278a5dbf922ddb8da4fdc4

        SHA256

        aef7af3a5f55f3c48abb12eb361bf735d9b764ae242ce747cc0204b084750877

        SHA512

        8b22a91660aef24cc5d4bba7b1c5a7713e605202cfce3fc2fa64dfee2ac4dbf58243142fa377f7b43b4487c5d2ab6708d3156dcacb95e500e8b8e645db3c158a

      • C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.dll
        Filesize

        623KB

        MD5

        103866fff4628ada4be6e5235b2ebf5d

        SHA1

        86ca018b33c7cdb953371ee1e290313b9a54a251

        SHA256

        963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c

        SHA512

        2a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3

      • C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.tlb
        Filesize

        3KB

        MD5

        3c920faafd032eeda08e4166860d4318

        SHA1

        26451ee3659c4a217f42ebd07f254679ab452f3a

        SHA256

        3377d0af1044505271c64fc342e22a7a24b757e5471657f656ac743373e22857

        SHA512

        327668001f94842eee3ff1dc44c70ddca5da3a0bb49aeea6b3162608b07496456e78bcb3de0462e5e375b349e813f13fd02e61b9e389b1d954cea2628c3c4a6e

      • C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.x64.dll
        Filesize

        700KB

        MD5

        401087ab67c6d917bf08d82f011d9eee

        SHA1

        d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

        SHA256

        fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

        SHA512

        4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

      • C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.x64.dll
        Filesize

        700KB

        MD5

        401087ab67c6d917bf08d82f011d9eee

        SHA1

        d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

        SHA256

        fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

        SHA512

        4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

      • C:\Program Files (x86)\GoSavE\Foq3GOH4wHsfSd.x64.dll
        Filesize

        700KB

        MD5

        401087ab67c6d917bf08d82f011d9eee

        SHA1

        d13dbf241d214d6036f8c6276e0e305fc2ac2b8a

        SHA256

        fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5

        SHA512

        4d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6

      • memory/2508-141-0x0000000000000000-mapping.dmp
      • memory/2536-138-0x0000000000000000-mapping.dmp
      • memory/4284-132-0x0000000002DF0000-0x0000000002E94000-memory.dmp
        Filesize

        656KB