65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca

Analysis

max time kernel
62s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe
Size

2.0MB
MD5

9ffe024b402e753fa371db83a84d2daf
SHA1

6ac633c9c486eacc872e0183e94901a4467fc6fa
SHA256

65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca
SHA512

d649a3ea5342fb8269c9ebea24641a85c5bac64e994b9f3016b3f0455006d91a257f7714d5bac8fd529fbf53f558acbcd0b12272e82df74ffff81f33519efa58
SSDEEP

24576:h1OYdaOdSuVW1jLH2NuSk/EWygQAlHE/HsvleTzEmupJcjoCQ40MMvppEWJbjSSf:h1OssyjkEWygQuk/HsNyz2pJxCeg3ja

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	deZKQqR1bBOHN6U.exe

Loads dropped DLL 4 IoCs

pid	Process
772	65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe
892	deZKQqR1bBOHN6U.exe
564	regsvr32.exe
1476	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eeejbmcdbfccbkjhciojackoackimmde\2.0\manifest.json	deZKQqR1bBOHN6U.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eeejbmcdbfccbkjhciojackoackimmde\2.0\manifest.json	deZKQqR1bBOHN6U.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eeejbmcdbfccbkjhciojackoackimmde\2.0\manifest.json	deZKQqR1bBOHN6U.exe

Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	deZKQqR1bBOHN6U.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	deZKQqR1bBOHN6U.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	deZKQqR1bBOHN6U.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	deZKQqR1bBOHN6U.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	deZKQqR1bBOHN6U.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.dll	deZKQqR1bBOHN6U.exe
File opened for modification	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.dll	deZKQqR1bBOHN6U.exe
File created	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.tlb	deZKQqR1bBOHN6U.exe
File opened for modification	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.tlb	deZKQqR1bBOHN6U.exe
File created	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.dat	deZKQqR1bBOHN6U.exe
File opened for modification	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.dat	deZKQqR1bBOHN6U.exe
File created	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll	deZKQqR1bBOHN6U.exe
File opened for modification	C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll	deZKQqR1bBOHN6U.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 892	772	65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe	28
PID 772 wrote to memory of 892	772	65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe	28
PID 772 wrote to memory of 892	772	65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe	28
PID 772 wrote to memory of 892	772	65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe	28
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 892 wrote to memory of 564	892	deZKQqR1bBOHN6U.exe	29
PID 564 wrote to memory of 1476	564	regsvr32.exe	30
PID 564 wrote to memory of 1476	564	regsvr32.exe	30
PID 564 wrote to memory of 1476	564	regsvr32.exe	30
PID 564 wrote to memory of 1476	564	regsvr32.exe	30
PID 564 wrote to memory of 1476	564	regsvr32.exe	30
PID 564 wrote to memory of 1476	564	regsvr32.exe	30
PID 564 wrote to memory of 1476	564	regsvr32.exe	30

C:\Users\Admin\AppData\Local\Temp\65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe
"C:\Users\Admin\AppData\Local\Temp\65d4648bef8d7dd02647c180a23d3000497da5f7d52a260ee40a53c1c5a5c8ca.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\deZKQqR1bBOHN6U.exe
  .\deZKQqR1bBOHN6U.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.dat

Filesize
6KB

MD5
95cef6708f6abdeab31e1a90222c8d79

SHA1
60d2e897dd35a60515b4b003b21ef689f595bbb9

SHA256
0bce833d1f160fea19e1c724cde59cb25f64c550920e87d61d62b7e8d181ad75

SHA512
0b93852abdb2dc37fb83fea8806793a42e1faf0b817745b62742941b30ce6ee2ba788038a6576885b5847e7e0d09e92c3dc0d6d52cdcf486b19422076ba58e18

Download Submit
C:\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\0nGA46zgIFbmgA.dll

Filesize
601KB

MD5
b2d96a149b60854cc5b1507669d2a304

SHA1
bdc467f91f97157135a105655a64cdbe0329726e

SHA256
0cf7b5e1246bb9e2ffd69eac2374f058415680a2b8c83e973c56704686f7732c

SHA512
169123d99ac34c6905abbe3f5bcb8b0f56e7c5ac5f4b51c9fd66d71c629aa71fab5f968d8b864c477fe63c47cede0fb2e59ce531f923d0e6b4729c462cead138

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\0nGA46zgIFbmgA.tlb

Filesize
3KB

MD5
ed92e596a3dd1aeb2a2a6f9507d95bd6

SHA1
f9e9123daf4781d41717e4a6be6e8f53d021a649

SHA256
434a86d8dcdfc895780d8346f36c99e5cde98bc919590af06d07f1e73745ee58

SHA512
ed3c52387f6e7d173c7058f13238be3a6604dd98b86cc03831ec737d43b2d2060182e2d9865b3c13d5dc39fcc7286cb589c041ba75999ca075d1e9237fab3473

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\0nGA46zgIFbmgA.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
b30a15b16892a410bf51830136256606

SHA1
e345a1419abbd11cb21080dac5eb7c7857f38795

SHA256
e2da7524a172bcecff238bc1e898a8641971c26bb5816b755ad501c82ada2eb1

SHA512
cc7e033e986bbe94fd33e4e8878c3a9e3f0af62ea71e0cbb1a2c00137130ee0465e0e1bf0a87941a69b725f44a0c426a4697a3f2ea0b60f89d9d871c6e86bb44

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
6edf3d6d2a0f931cb97338861f3594a9

SHA1
c936ab8a8a013706f7e42b8a5b7a45ee62b798e2

SHA256
bea7e561960aae5a24f0ac5fb4939f88798dd587c1b3a5981dcdee294c18c633

SHA512
86aff3de3858c726c382f60367dd9a9fd8c83c03e661320ce4a95dd363d1fb33fd4a11cd6251ea3e10f75d608fb8d84c913fb40148b15d610009a83e97a77180

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\[email protected]\install.rdf

Filesize
591B

MD5
ffee46f726804c50b65e74526f1b8fd8

SHA1
f05405790a386753a8b1aa4ed789f1f1d6513dd7

SHA256
fc6ce5251ecb5ba3f494f1030f64e899e3c63ab7dffaf2f1d606c4d0f06ad6a5

SHA512
fc08810d98b9673f83f4ed7ea4b0321578d189b058489707f3485f4ab734814f840445cf5e33d118aafb1b425a369d55117e61781954294e6d76b497bf0fb772

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\deZKQqR1bBOHN6U.dat

Filesize
6KB

MD5
95cef6708f6abdeab31e1a90222c8d79

SHA1
60d2e897dd35a60515b4b003b21ef689f595bbb9

SHA256
0bce833d1f160fea19e1c724cde59cb25f64c550920e87d61d62b7e8d181ad75

SHA512
0b93852abdb2dc37fb83fea8806793a42e1faf0b817745b62742941b30ce6ee2ba788038a6576885b5847e7e0d09e92c3dc0d6d52cdcf486b19422076ba58e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\deZKQqR1bBOHN6U.exe

Filesize
649KB

MD5
524bc23df65cfdcc39056b69feba32e5

SHA1
2a88ec175c164ff14b69d1d5b21384e60400a191

SHA256
0d0d750316b3e35d6c625c8b883fcffa80ffff52c24921f324baf0197b89dcea

SHA512
483f1c25253ec362be18b1640bf24cca9439d843f12011c56a9c67f2a7622c3d26b6f1bb4e16e4435edf371a4dcb637d625ef1bceda7d1e0d76cb8accbdb67bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\deZKQqR1bBOHN6U.exe

Filesize
649KB

MD5
524bc23df65cfdcc39056b69feba32e5

SHA1
2a88ec175c164ff14b69d1d5b21384e60400a191

SHA256
0d0d750316b3e35d6c625c8b883fcffa80ffff52c24921f324baf0197b89dcea

SHA512
483f1c25253ec362be18b1640bf24cca9439d843f12011c56a9c67f2a7622c3d26b6f1bb4e16e4435edf371a4dcb637d625ef1bceda7d1e0d76cb8accbdb67bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\eeejbmcdbfccbkjhciojackoackimmde\background.html

Filesize
140B

MD5
a50fe9980aa1dcc64c872b0c0596e1c4

SHA1
f64a1a55e2a9134bcbe47395d561aa8c3b74caf4

SHA256
9f25ad82f74d3d57efb2328b7eb63e9ad9b0c900239733286eadf4cf4fab1174

SHA512
f91da8f7be06b1815aaee668eb8adb1e5e4603db220e873adb7c3acbfb1dcad9fef829bfd7bb5e11aa278705dc5ca812659918e74b29a58402d3152793d598e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\eeejbmcdbfccbkjhciojackoackimmde\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\eeejbmcdbfccbkjhciojackoackimmde\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\eeejbmcdbfccbkjhciojackoackimmde\manifest.json

Filesize
498B

MD5
89a241d9a52cb219f29cebedc468a56c

SHA1
32d0c1c01e5edcd477ab02fe1ea66ee36f3edd66

SHA256
3e1d41b33440994a6f512014f98fae28bd40b625a2bc80f16290cf8a961fd4a8

SHA512
cc783a38629e69e98f45d4bbc69e6cad70b59caf7886b95aefc6b564be79730d7bd7c4268e20c2be8bc3e3073ecb0c2eed584c7226b95f9707661c82fc7455be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\eeejbmcdbfccbkjhciojackoackimmde\yhi.js

Filesize
5KB

MD5
e1aea24b1e6d913e5dd2acba08a4d797

SHA1
3052b06bc1f85dcd079386adc3db9e1bca711a5a

SHA256
2d7879985541ff4489f6125a4ffd3d51663a4c397b1e43b8f92905c49ea329eb

SHA512
10966236ce35594f607ecdf6200220c731de9e33364645c405ee2587e7ee11d72a8b1fd6c053d78bfb9a53af2dcf1b6747fb6bfed2e398ed254944a08aebcef6

Download Submit
\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.dll

Filesize
601KB

MD5
b2d96a149b60854cc5b1507669d2a304

SHA1
bdc467f91f97157135a105655a64cdbe0329726e

SHA256
0cf7b5e1246bb9e2ffd69eac2374f058415680a2b8c83e973c56704686f7732c

SHA512
169123d99ac34c6905abbe3f5bcb8b0f56e7c5ac5f4b51c9fd66d71c629aa71fab5f968d8b864c477fe63c47cede0fb2e59ce531f923d0e6b4729c462cead138

Download Submit
\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
\Program Files (x86)\GoSaVe\0nGA46zgIFbmgA.x64.dll

Filesize
679KB

MD5
2248a27000a39605618b39ed313bb860

SHA1
dc83459cd843029e7e1ae82dee04c7a930a16bf8

SHA256
39f7f2287a8604c54e11b83e4ec834b8f2c9a528c231bf98c2b8b38949ab4d18

SHA512
b4207d8b954bbeb466c59c883d09de11a3c3e1169f531cfbc853fa9c6f34a1b786999b334f73637a243ba08f0a532a7f672772acb7f27d31820fcf49ca74d801

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5C92.tmp\deZKQqR1bBOHN6U.exe

Filesize
649KB

MD5
524bc23df65cfdcc39056b69feba32e5

SHA1
2a88ec175c164ff14b69d1d5b21384e60400a191

SHA256
0d0d750316b3e35d6c625c8b883fcffa80ffff52c24921f324baf0197b89dcea

SHA512
483f1c25253ec362be18b1640bf24cca9439d843f12011c56a9c67f2a7622c3d26b6f1bb4e16e4435edf371a4dcb637d625ef1bceda7d1e0d76cb8accbdb67bd

Download Submit
memory/772-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1476-78-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download