dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159

Analysis

max time kernel
115s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe
Size

2.1MB
MD5

46ec1cc3f49971d766504be135dd73fd
SHA1

e50dbe394498f104df5192f7d2059925c8c2741b
SHA256

dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159
SHA512

0e7014daf3959f21bcbb886c79f57422e7e91f0328ea58d2da865343b2e2c2798a0f3f48e0b2ca2b28a31801a1c7d79b93ffdc3ecb4f090798d5795083a69383
SSDEEP

24576:h1OYdaOQidvpcWU0nkjpTu1aiwB+JtP2ItjRwcOHx0pFz8rrqbk8250uj5rc6bJI:h1OsL5/nkFTZaPPRwTR0ptyI2q8jbJG3

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
932	TfbOLI0RNSOkIAi.exe

Loads dropped DLL 4 IoCs

pid	Process
1440	dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe
932	TfbOLI0RNSOkIAi.exe
1060	regsvr32.exe
1812	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfadpgcdlobekjipebneiiipigkcjpm\2.0\manifest.json	TfbOLI0RNSOkIAi.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfadpgcdlobekjipebneiiipigkcjpm\2.0\manifest.json	TfbOLI0RNSOkIAi.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfadpgcdlobekjipebneiiipigkcjpm\2.0\manifest.json	TfbOLI0RNSOkIAi.exe

Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	TfbOLI0RNSOkIAi.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	TfbOLI0RNSOkIAi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	TfbOLI0RNSOkIAi.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	TfbOLI0RNSOkIAi.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	TfbOLI0RNSOkIAi.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.tlb	TfbOLI0RNSOkIAi.exe
File opened for modification	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.tlb	TfbOLI0RNSOkIAi.exe
File created	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.dat	TfbOLI0RNSOkIAi.exe
File opened for modification	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.dat	TfbOLI0RNSOkIAi.exe
File created	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll	TfbOLI0RNSOkIAi.exe
File opened for modification	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll	TfbOLI0RNSOkIAi.exe
File created	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.dll	TfbOLI0RNSOkIAi.exe
File opened for modification	C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.dll	TfbOLI0RNSOkIAi.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 932	1440	dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe	28
PID 1440 wrote to memory of 932	1440	dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe	28
PID 1440 wrote to memory of 932	1440	dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe	28
PID 1440 wrote to memory of 932	1440	dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe	28
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 932 wrote to memory of 1060	932	TfbOLI0RNSOkIAi.exe	29
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30
PID 1060 wrote to memory of 1812	1060	regsvr32.exe	30

C:\Users\Admin\AppData\Local\Temp\dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe
"C:\Users\Admin\AppData\Local\Temp\dfa9068e870f66762fbdd75cb759c52d7b43ce0e3bcbf266b57477db143c0159.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\TfbOLI0RNSOkIAi.exe
  .\TfbOLI0RNSOkIAi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.dat

Filesize
6KB

MD5
d557788537e5b9ddabeed5546605376b

SHA1
a995336cff4a93fc4a3f9ebc49ffdd314618acbc

SHA256
b0a0a83039a70caf92016bc79fd176071bf7ef5b0f351a30119fca2164d08ebe

SHA512
d46f918ef7a51bc43480cb11700e798d42a22c34a2be60342b21ecb94f4d1c7fdb6c4bfba0b3e7e3db41bddd7731f507acb845872be02b80b7dd93bf9866456b

Download Submit
C:\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\Dl3G8oxLXjIN90.dll

Filesize
608KB

MD5
0a8d35bd724d803984bb64ae91deb8b5

SHA1
1d2a0e9db9278fde2d2aab979036671f2985c4be

SHA256
a44498519e643c24d57943cdf34d8ced80fce043a370c29def1a0f7388dde3a2

SHA512
9c3a21f75c5598976ef5896eca7e21a7f8d86f5948756e07f16f3528384c7dbe54cdaedd6d07bfdafb165d9a570d12db1ec3b20e74ca0d9cb944e1cfa85e5934

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\Dl3G8oxLXjIN90.tlb

Filesize
3KB

MD5
825074f7df4e6542c682e2529c7c2bc8

SHA1
0c11e0abe3bd3bfd0edaa4a9e79c65cf165ca7ed

SHA256
cf76185e63bf7b048aaccabe85522f4bbf987cd159e93dc7e8ee3f13312e101e

SHA512
d249ba8d1f5940dcdd745f13e9ead69469cf8c547561a06bcc443c20b1a62fce799e59dc59fc5d07d312836bbeed1c85a9abc943210d328c7605b502a520d44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\Dl3G8oxLXjIN90.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\TfbOLI0RNSOkIAi.dat

Filesize
6KB

MD5
d557788537e5b9ddabeed5546605376b

SHA1
a995336cff4a93fc4a3f9ebc49ffdd314618acbc

SHA256
b0a0a83039a70caf92016bc79fd176071bf7ef5b0f351a30119fca2164d08ebe

SHA512
d46f918ef7a51bc43480cb11700e798d42a22c34a2be60342b21ecb94f4d1c7fdb6c4bfba0b3e7e3db41bddd7731f507acb845872be02b80b7dd93bf9866456b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\TfbOLI0RNSOkIAi.exe

Filesize
643KB

MD5
239a80538887713f0d8471057f55e170

SHA1
4df6ef79bd07d962cc09c1279248af034fd22d03

SHA256
0ced38390b12b12a9aaec52a2ad8664e603c825abb318e5b743aed8a09afab78

SHA512
7b8c6f8270e2d7a2501e9eb11af4905d299c5e5dc3bd3b5bf8073cb22fd5677401ed2dd748d6ae0560be988bce257ca92ec19aa7b78740aa5ec53d98cf4936aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\TfbOLI0RNSOkIAi.exe

Filesize
643KB

MD5
239a80538887713f0d8471057f55e170

SHA1
4df6ef79bd07d962cc09c1279248af034fd22d03

SHA256
0ced38390b12b12a9aaec52a2ad8664e603c825abb318e5b743aed8a09afab78

SHA512
7b8c6f8270e2d7a2501e9eb11af4905d299c5e5dc3bd3b5bf8073cb22fd5677401ed2dd748d6ae0560be988bce257ca92ec19aa7b78740aa5ec53d98cf4936aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
96f65da40fc2651bca6db531d532a75e

SHA1
71f8d7b16408e0b13a354b4d6fc01ab6cb060f6c

SHA256
5023fc5ef7a0743151e6bab31e08ffb9844eba4249a38223ddc74a0430ee1013

SHA512
9c566e42de4d1718b0f1a05cbf42ff8cf1e53d223e242e6d2e5c297cc0b49c9ae4f1d901ee43685a9d43c4a0c7f31e3bdb65fa3452fc503326744a7d344ef345

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
728c365ef3b7328b3b49dc553d37d56a

SHA1
6768613004e44bc0259afd3e3209f82895aed83e

SHA256
9a75fd75a90c6bcdfd7b6326b56fc0127665a5be3c25b35209c6dd3ac37f6012

SHA512
68cbd6d1a126298e33cbb92815e4e172e74ea16c1124954dc427c44ebeeca303c4967d2564581c8dad49f3fa7b350fb94a8dffb4771ca2715d3195380ce6a0ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\[email protected]\install.rdf

Filesize
598B

MD5
258f310447a7660241fbf197170343f5

SHA1
58ba9fe654c3a48291fd1aca8ee079b23f5939b2

SHA256
00fd5ee753c8849f34b524ef9c25c45ddb8918e501bf09a79a5e4584d54595f6

SHA512
224aab601890e85782d05600b199059dd17bbf37f850c4e6977e5d92edb99c27fe85cb3ea952d23bb6084b832a747206af79b9b4ee9b98df1f1c9203d7f09b25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\mhfadpgcdlobekjipebneiiipigkcjpm\O5.js

Filesize
5KB

MD5
e40e49faba5b2c7881a35b4e96a2107b

SHA1
7da323a5776dadbbc7b127590cb8d2e222a24c47

SHA256
36014219f2a7dfeed4a042ad0e70ea7a74b5b75744576f0a5fda7bf6728af96e

SHA512
e5c44a4c88396675f84cfe62a6fa7408195569646b22849a8ba981b55aa1b4d2238232d11694a55bb5c9cfc682aebd7f20b417a423c735ca621735ec1be825c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\mhfadpgcdlobekjipebneiiipigkcjpm\background.html

Filesize
139B

MD5
2f504245eaaefa4c18cbc620979667a5

SHA1
a4afd953a435f2dc39939053594bce8a32207163

SHA256
92c837cd1ae611aea9e2764f922ca9d4fa9019f9878e15bae254bc77ab160a46

SHA512
ccccce22837407161a0ad55901b59f85fa5c6be60a3acb7360372a0700e8cae782f4d04c725b01e08d7e095702380abfe2d3eb91120be9139f18050e3eb2660e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\mhfadpgcdlobekjipebneiiipigkcjpm\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\mhfadpgcdlobekjipebneiiipigkcjpm\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\mhfadpgcdlobekjipebneiiipigkcjpm\manifest.json

Filesize
499B

MD5
fc8d04ff5bfcd4ab16fd631375ac4385

SHA1
9f6fd935c518f8c03ecada4226e8b382f0e0041c

SHA256
deaddae9afefae3ebc8d1e0188b9d2a199ac5c879e83addf0c244d68a168167b

SHA512
3b5ad32274b4ff7794a22606ddb76b04e1555c5629750ce9e614ba5d57397d8fa4c6cac5b7366dd8eb5726fc2cef39f598593e47d74ae75f361d385a443e3e32

Download Submit
\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.dll

Filesize
608KB

MD5
0a8d35bd724d803984bb64ae91deb8b5

SHA1
1d2a0e9db9278fde2d2aab979036671f2985c4be

SHA256
a44498519e643c24d57943cdf34d8ced80fce043a370c29def1a0f7388dde3a2

SHA512
9c3a21f75c5598976ef5896eca7e21a7f8d86f5948756e07f16f3528384c7dbe54cdaedd6d07bfdafb165d9a570d12db1ec3b20e74ca0d9cb944e1cfa85e5934

Download Submit
\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
\Program Files (x86)\GoSAaVe\Dl3G8oxLXjIN90.x64.dll

Filesize
687KB

MD5
eb9b79bcb3041dad9754753cb8290dfa

SHA1
9ef9446b24e067c4ccf2b750f15adbdd5d748a55

SHA256
14338baeee3f7acff67d3aba587e71991022bac28da4f2763f5b9eda6f681bd6

SHA512
52fec043c6d2025268963790990fad7cec2ef384a778f4ad3e1cd75eaf75efef0a70b497f0e30b7c792d14903d5a4950fd4ab4f956301272641c65f2cd888f43

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7AEB.tmp\TfbOLI0RNSOkIAi.exe

Filesize
643KB

MD5
239a80538887713f0d8471057f55e170

SHA1
4df6ef79bd07d962cc09c1279248af034fd22d03

SHA256
0ced38390b12b12a9aaec52a2ad8664e603c825abb318e5b743aed8a09afab78

SHA512
7b8c6f8270e2d7a2501e9eb11af4905d299c5e5dc3bd3b5bf8073cb22fd5677401ed2dd748d6ae0560be988bce257ca92ec19aa7b78740aa5ec53d98cf4936aa

Download Submit
memory/1440-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1812-79-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download