a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe
Size

2.0MB
MD5

a083d8b9e03927bf3fa918c6f1d95e8d
SHA1

4a6313a3bcc51f40aed20a32a9e99af7b106ae1d
SHA256

a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762
SHA512

78bf76c41fb90573bc1c249f9921da10406d15625f5b2265c08911ae40cdbd8a4da96da1c0ef57de723cd8e77e71681114950af7126026825ad040bd448bac7c
SSDEEP

24576:h1OYdaOkSuVW1jLH2NuSk/EWygQAlHE/HsvleTzEmupJcjoCQ40MMvppEWJbjSS/:h1OsxyjkEWygQuk/HsNyz2pJxCeg3jM

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1508	Og22d0O7c5mY6k8.exe

Loads dropped DLL 4 IoCs

pid	Process
1092	a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe
1508	Og22d0O7c5mY6k8.exe
1944	regsvr32.exe
1288	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmpkdeaaphlnbhabkdbilmckjofmadn\1.3\manifest.json	Og22d0O7c5mY6k8.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmpkdeaaphlnbhabkdbilmckjofmadn\1.3\manifest.json	Og22d0O7c5mY6k8.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmpkdeaaphlnbhabkdbilmckjofmadn\1.3\manifest.json	Og22d0O7c5mY6k8.exe

Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	Og22d0O7c5mY6k8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	Og22d0O7c5mY6k8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	Og22d0O7c5mY6k8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	Og22d0O7c5mY6k8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	Og22d0O7c5mY6k8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll	Og22d0O7c5mY6k8.exe
File opened for modification	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll	Og22d0O7c5mY6k8.exe
File created	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.dll	Og22d0O7c5mY6k8.exe
File opened for modification	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.dll	Og22d0O7c5mY6k8.exe
File created	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.tlb	Og22d0O7c5mY6k8.exe
File opened for modification	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.tlb	Og22d0O7c5mY6k8.exe
File created	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.dat	Og22d0O7c5mY6k8.exe
File opened for modification	C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.dat	Og22d0O7c5mY6k8.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1508	1092	a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe	27
PID 1092 wrote to memory of 1508	1092	a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe	27
PID 1092 wrote to memory of 1508	1092	a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe	27
PID 1092 wrote to memory of 1508	1092	a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe	27
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1508 wrote to memory of 1944	1508	Og22d0O7c5mY6k8.exe	28
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29
PID 1944 wrote to memory of 1288	1944	regsvr32.exe	29

C:\Users\Admin\AppData\Local\Temp\a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe
"C:\Users\Admin\AppData\Local\Temp\a69a8069dad8ae97e4bebc16eb4d208ed8569d02da3b118cd4e2b932d6779762.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\Og22d0O7c5mY6k8.exe
  .\Og22d0O7c5mY6k8.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.dat

Filesize
6KB

MD5
f0031d518b1738e84d8081dff7991835

SHA1
5b935ece7256a6d7ab664d2d8779d15435bce03e

SHA256
d89795ab18e302d8c6f8de62877b9dfc56a26b717e502edd098f11f6ec0e360e

SHA512
c7685304872f4acce5b1f91db57d5903ec0cdf64fc60cb774cc18b3e898b73ee681d97dee92c2d105a58394461d7862f0241e7ec736d3c386c5f7bfb902b1eb6

Download Submit
C:\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\7a3GVg7ttaUAy3.dll

Filesize
601KB

MD5
b2d96a149b60854cc5b1507669d2a304

SHA1
bdc467f91f97157135a105655a64cdbe0329726e

SHA256
0cf7b5e1246bb9e2ffd69eac2374f058415680a2b8c83e973c56704686f7732c

SHA512
169123d99ac34c6905abbe3f5bcb8b0f56e7c5ac5f4b51c9fd66d71c629aa71fab5f968d8b864c477fe63c47cede0fb2e59ce531f923d0e6b4729c462cead138

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\7a3GVg7ttaUAy3.tlb

Filesize
3KB

MD5
ed92e596a3dd1aeb2a2a6f9507d95bd6

SHA1
f9e9123daf4781d41717e4a6be6e8f53d021a649

SHA256
434a86d8dcdfc895780d8346f36c99e5cde98bc919590af06d07f1e73745ee58

SHA512
ed3c52387f6e7d173c7058f13238be3a6604dd98b86cc03831ec737d43b2d2060182e2d9865b3c13d5dc39fcc7286cb589c041ba75999ca075d1e9237fab3473

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\7a3GVg7ttaUAy3.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\Og22d0O7c5mY6k8.dat

Filesize
6KB

MD5
f0031d518b1738e84d8081dff7991835

SHA1
5b935ece7256a6d7ab664d2d8779d15435bce03e

SHA256
d89795ab18e302d8c6f8de62877b9dfc56a26b717e502edd098f11f6ec0e360e

SHA512
c7685304872f4acce5b1f91db57d5903ec0cdf64fc60cb774cc18b3e898b73ee681d97dee92c2d105a58394461d7862f0241e7ec736d3c386c5f7bfb902b1eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\Og22d0O7c5mY6k8.exe

Filesize
649KB

MD5
524bc23df65cfdcc39056b69feba32e5

SHA1
2a88ec175c164ff14b69d1d5b21384e60400a191

SHA256
0d0d750316b3e35d6c625c8b883fcffa80ffff52c24921f324baf0197b89dcea

SHA512
483f1c25253ec362be18b1640bf24cca9439d843f12011c56a9c67f2a7622c3d26b6f1bb4e16e4435edf371a4dcb637d625ef1bceda7d1e0d76cb8accbdb67bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\Og22d0O7c5mY6k8.exe

Filesize
649KB

MD5
524bc23df65cfdcc39056b69feba32e5

SHA1
2a88ec175c164ff14b69d1d5b21384e60400a191

SHA256
0d0d750316b3e35d6c625c8b883fcffa80ffff52c24921f324baf0197b89dcea

SHA512
483f1c25253ec362be18b1640bf24cca9439d843f12011c56a9c67f2a7622c3d26b6f1bb4e16e4435edf371a4dcb637d625ef1bceda7d1e0d76cb8accbdb67bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\obmpkdeaaphlnbhabkdbilmckjofmadn\I.js

Filesize
5KB

MD5
5d76dee7ccf47dc60c963a137fed4907

SHA1
9b86155f51a0db33808281644329846ca62dff22

SHA256
59b2c48a0d4ea745303f4c90ee1ca1d925f2ac7702ddd466afe4a62949a395f2

SHA512
492b2aec08e1c1385a6f36d74cd6f8f0c620904a7f35d59c6a10952672f4b0d20088e142d0dea5e807a0eceb0eb36bf65d5cfc803382f4be12d9fe3a1eefadd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\obmpkdeaaphlnbhabkdbilmckjofmadn\background.html

Filesize
138B

MD5
ea50135f334b15a15b3e07740f71e919

SHA1
7ad7d07cb16f590b468bd5356c12994954f58c92

SHA256
623dc65e91d7a9b2aef1866029423203ee69a6f7b0fefe440ab3aaaaa4396b02

SHA512
1105f6d5864ef2afe8ff871e545622750e460e296c0a4a936ce5c9d83e140259eebad727427243fca3f544e541ee2831b31f57ceddb17cfdc1c44479944b8d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\obmpkdeaaphlnbhabkdbilmckjofmadn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\obmpkdeaaphlnbhabkdbilmckjofmadn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\obmpkdeaaphlnbhabkdbilmckjofmadn\manifest.json

Filesize
500B

MD5
cdac7fcb166681a5683ee348dba792fa

SHA1
3ec7ce05db6fe25e119b22051a4f5d8fffb9ad17

SHA256
8890b69281ff3847c6ab0de8d88784699f9c60543469dcef8df7dafaf0a7bbab

SHA512
9d3d3dabf7ab4988793128c408f9284c8b6e2785b4291642f8d6f4b44c144fcffa322becd1f87b122b115321a3502bd5c75ac30ff0ae1cd6d1cfce6ca4d6425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
2e6d7c8cca633a5b023b8b9cac43bef1

SHA1
0a6acf8d86f25795926c836468f5ac6db8cf6bae

SHA256
3c49d9fcf640468d8a689833514ad8cd8e17f218894f3e46f7b0e1fb6d44ccb0

SHA512
4e592a915c562099bc0b15963e3ed871f686180db5d1edeaa4286921ca1330fffcdff0894b9c68b348a3045e9db41f499fd4ee4d19635db3c3bd073a74011f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
256a4cd8dc5d890b02bd89ddd5ac7139

SHA1
d79b7a7e3fa03c972e9726632be74fd405a916be

SHA256
e275e2a06f4963584b00d2353ef8ac88e120632407e466c44406271816fdb3fe

SHA512
9ed0c941529d04bfa738942eec32c103d8221b4cb1a6e4684ba733c4603aa11c28837598936d28e15e00728308239a3bafbde54e768a2bfd69dbb0ee8805c31e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS143D.tmp\[email protected]\install.rdf

Filesize
598B

MD5
afd2e075e816cdb68964af48ff7f1f9d

SHA1
a994a9259cb03a740b204fbc32ceab097a7f41e6

SHA256
031e39460c250d16506b5a584ab9dcf775e0f8d878d4262ec4a9b0b5176e34b2

SHA512
246006d47e595ecdefaebd916b73b2affab14c3571e5af1e98f00e1aa3a168ace26508d963948bb52e47b477072e11277be63e807069a9b9d73a4f743876ffde

Download Submit
\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.dll

Filesize
601KB

MD5
b2d96a149b60854cc5b1507669d2a304

SHA1
bdc467f91f97157135a105655a64cdbe0329726e

SHA256
0cf7b5e1246bb9e2ffd69eac2374f058415680a2b8c83e973c56704686f7732c

SHA512
169123d99ac34c6905abbe3f5bcb8b0f56e7c5ac5f4b51c9fd66d71c629aa71fab5f968d8b864c477fe63c47cede0fb2e59ce531f923d0e6b4729c462cead138

Download Submit
\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
\Program Files (x86)\VAiuudix\7a3GVg7ttaUAy3.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
\Users\Admin\AppData\Local\Temp\7zS143D.tmp\Og22d0O7c5mY6k8.exe

Filesize
649KB

MD5
524bc23df65cfdcc39056b69feba32e5

SHA1
2a88ec175c164ff14b69d1d5b21384e60400a191

SHA256
0d0d750316b3e35d6c625c8b883fcffa80ffff52c24921f324baf0197b89dcea

SHA512
483f1c25253ec362be18b1640bf24cca9439d843f12011c56a9c67f2a7622c3d26b6f1bb4e16e4435edf371a4dcb637d625ef1bceda7d1e0d76cb8accbdb67bd

Download Submit
memory/1092-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1288-78-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download