Overview

overview

8

Static

static

ed5e4ac76e...89.exe

windows7-x64

8

ed5e4ac76e...89.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    126s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 06:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed5e4ac76e01d5c9a327d5e3fa06737df43a62d538a28c19b23b7f39a18bc989.exe

  • Size

    3.8MB

  • MD5

    0c84b613573bcd8f0eb5400ce88bc667

  • SHA1

    54dab937f79ebd5baf09d7cca08a76957495a0eb

  • SHA256

    ed5e4ac76e01d5c9a327d5e3fa06737df43a62d538a28c19b23b7f39a18bc989

  • SHA512

    8021e8674d9d16283e845c06d0b773357d080db36891ed5685fa5f57271b637f714d803ced7e57b77efbba5d0c750016136fc1e6c25296cafbbcbae6147edbcc

  • SSDEEP

    98304:PCVoKYQbbJNlgCgdU+gFmKUULZJLqL7kAEpEGT0AJ7t9LVvranzpfaZ:koKP3JN/+aT9+nzp

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed5e4ac76e01d5c9a327d5e3fa06737df43a62d538a28c19b23b7f39a18bc989.exe
    "C:\Users\Admin\AppData\Local\Temp\ed5e4ac76e01d5c9a327d5e3fa06737df43a62d538a28c19b23b7f39a18bc989.exe"
    1⤵
    • Loads dropped DLL
    • Drops Chrome extension
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3224
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:4644
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:224
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:3596

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Browser Extensions

      1
      T1176

      Privilege Escalation

      Defense Evasion

      Modify Registry

      3
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.dat
        Filesize

        4KB

        MD5

        83dd8cf9fa0fde179ba2a92b6003e00b

        SHA1

        43152eadcc364a780f543d45af9be0106ca1d813

        SHA256

        2df09d7627e1f0d01777c0a31b99aa7a8ccf98f083d6aed7c65bd97e79aa1cc2

        SHA512

        f0bc27294e9354a0a783d7fe0a93f3036a2c32cd7d3bcfcd13e78b122db4d5584e707f30ac934bb463e0d93098ebb350ac10907e5ae0043229fa5f2bbeefa406

        Download Submit
      • C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.dll
        Filesize

        615KB

        MD5

        7bcbc1267b58f0b7147373180de1f7f0

        SHA1

        683da53d33a2889f3cbab02e1678528490f10916

        SHA256

        c8ea6a0b4bddd26d19c10d32ee92cacfa87ec68d4412ae2d15ee4e7038f1b666

        SHA512

        1594cec496a4068eb3a417f4643837412cbd9fbc4349517d8705449dace091db2d89b8496ffe20651fcc6b0d77e94211924ebddc764d910ef0cb86e72a715a67

        Download Submit
      • C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.tlb
        Filesize

        3KB

        MD5

        9118531242e7d086042b37efdce9b101

        SHA1

        ecc5947911756c031900a0f75ae15a8d627321dc

        SHA256

        a9510cbaa4561de318f727888576e387537db2848a95477a3940556752dfb306

        SHA512

        e4bf0104ba69741baf752535f92d5e763f7df099a7da8be7eb8e9307a0bd08eb8625ae991d8cfa21a6ac9e10e4f55b00d70b8220b4fad94761e79e4c69ac2f6c

        Download Submit
      • C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.x64.dll
        Filesize

        693KB

        MD5

        5998913e8943a7b684210fe19bad1e0e

        SHA1

        5c745d6faf13ffbc271fd661e5f18365fb6bac46

        SHA256

        11ef4753bd4abdf9ec650a637fecd8a549b5c08b6742554f228e222a76a1a1f6

        SHA512

        a0dc8441fe7c6aee3b43529ca5b0a7f77aad95dd58c6a7ebd47f3e9233e106ae321e5f77ae2675483e3f86f61e8ac2dc8750e2618265ae19575bc17cbd61aeef

        Download Submit
      • C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.x64.dll
        Filesize

        693KB

        MD5

        5998913e8943a7b684210fe19bad1e0e

        SHA1

        5c745d6faf13ffbc271fd661e5f18365fb6bac46

        SHA256

        11ef4753bd4abdf9ec650a637fecd8a549b5c08b6742554f228e222a76a1a1f6

        SHA512

        a0dc8441fe7c6aee3b43529ca5b0a7f77aad95dd58c6a7ebd47f3e9233e106ae321e5f77ae2675483e3f86f61e8ac2dc8750e2618265ae19575bc17cbd61aeef

        Download Submit
      • C:\Program Files (x86)\PricieLLEEss\IIGR4OnpOiuUCU.x64.dll
        Filesize

        693KB

        MD5

        5998913e8943a7b684210fe19bad1e0e

        SHA1

        5c745d6faf13ffbc271fd661e5f18365fb6bac46

        SHA256

        11ef4753bd4abdf9ec650a637fecd8a549b5c08b6742554f228e222a76a1a1f6

        SHA512

        a0dc8441fe7c6aee3b43529ca5b0a7f77aad95dd58c6a7ebd47f3e9233e106ae321e5f77ae2675483e3f86f61e8ac2dc8750e2618265ae19575bc17cbd61aeef

        Download Submit
      • memory/1444-138-0x0000000000000000-mapping.dmp
        Download
      • memory/3224-132-0x0000000002E20000-0x0000000002EC4000-memory.dmp
        Filesize

        656KB

        Download
      • memory/4644-141-0x0000000000000000-mapping.dmp
        Download