eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 19:38

Target

eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
Size

2.6MB
MD5

236e06fb9686d3d6d668ec5e972683a3
SHA1

f1c67092f449e31dfa117cc9c4d1b967a4697c7d
SHA256

eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0
SHA512

29e3a389fd9262b5eb807862e4cbb8e2e8a54547cf6a06fac2329269890028cc0cb0bed04934707cf5b9ef83e8e1c90eca3efc9087dd890518db781e64b3ab12
SSDEEP

49152:XmiFBnoDe9IqnCcjjkScbqYBCJg8lImitJgEauUm82ngUe0sc2:2KJCskLb5hWT3Eau1

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nacfbnjmbnnecjbfohlljpmbgobdpalb\2.0\manifest.json	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nacfbnjmbnnecjbfohlljpmbgobdpalb\2.0\manifest.json	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nacfbnjmbnnecjbfohlljpmbgobdpalb\2.0\manifest.json	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1196	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe
1196	eb351b69e1ff873f983f3e96e8257cd079c0919c414a8629b832647610d72ba0.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1196-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1196-55-0x0000000000340000-0x00000000003E5000-memory.dmp

Filesize
660KB

Download