a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e

Analysis

max time kernel
44s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe
Size

2.1MB
MD5

a0e764328d2f8cb72b0543e67345b89c
SHA1

fa6490a1c47f2679b43c7f471c3cb8a36d5aad09
SHA256

a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e
SHA512

186450c6e0f59c54272460ab6e68710d9ae7c3f635b4f15b06133eda11b27d256a77b9a4ed0cb5ea0b3bb5d5bf2fa64b4cb388b0ddaf8fc54d14eeeb212121dc
SSDEEP

24576:h1OYdaOTzoi5Fm2qmA+L4zKWQt0moNdqNFSj8y0j9jtaJB5ZuUUr2YGnEQ/VfVl:h1OsBmLmVJWQt0mozqW78bSVfVl

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
948	SdSvDCrZnIE9hHl.exe

Loads dropped DLL 4 IoCs

pid	Process
1596	a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe
948	SdSvDCrZnIE9hHl.exe
316	regsvr32.exe
1508	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnjaboilapokahgiljjclmpneholimm\2.0\manifest.json	SdSvDCrZnIE9hHl.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnjaboilapokahgiljjclmpneholimm\2.0\manifest.json	SdSvDCrZnIE9hHl.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnjaboilapokahgiljjclmpneholimm\2.0\manifest.json	SdSvDCrZnIE9hHl.exe

Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	SdSvDCrZnIE9hHl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	SdSvDCrZnIE9hHl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	SdSvDCrZnIE9hHl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	SdSvDCrZnIE9hHl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	SdSvDCrZnIE9hHl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll	SdSvDCrZnIE9hHl.exe
File opened for modification	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll	SdSvDCrZnIE9hHl.exe
File created	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.dll	SdSvDCrZnIE9hHl.exe
File opened for modification	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.dll	SdSvDCrZnIE9hHl.exe
File created	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.tlb	SdSvDCrZnIE9hHl.exe
File opened for modification	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.tlb	SdSvDCrZnIE9hHl.exe
File created	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.dat	SdSvDCrZnIE9hHl.exe
File opened for modification	C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.dat	SdSvDCrZnIE9hHl.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
948	SdSvDCrZnIE9hHl.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 948	1596	a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe	28
PID 1596 wrote to memory of 948	1596	a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe	28
PID 1596 wrote to memory of 948	1596	a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe	28
PID 1596 wrote to memory of 948	1596	a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe	28
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 948 wrote to memory of 316	948	SdSvDCrZnIE9hHl.exe	29
PID 316 wrote to memory of 1508	316	regsvr32.exe	30
PID 316 wrote to memory of 1508	316	regsvr32.exe	30
PID 316 wrote to memory of 1508	316	regsvr32.exe	30
PID 316 wrote to memory of 1508	316	regsvr32.exe	30
PID 316 wrote to memory of 1508	316	regsvr32.exe	30
PID 316 wrote to memory of 1508	316	regsvr32.exe	30
PID 316 wrote to memory of 1508	316	regsvr32.exe	30

C:\Users\Admin\AppData\Local\Temp\a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe
"C:\Users\Admin\AppData\Local\Temp\a26413971bccab3702f9fe30f7f6f666f26bf5caa298003fbe978386fd99bd4e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\SdSvDCrZnIE9hHl.exe
  .\SdSvDCrZnIE9hHl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:316
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.dat

Filesize
5KB

MD5
dcd169d93141fdc6fc8b09ee608d8099

SHA1
ce78788410bf274c6898e4dda7e662d404a7ac49

SHA256
57e444afc352c0c915ac5e14eeea2b6eb490b9462c290df471fb62e04f803fb9

SHA512
27347102e8c6c24bf1e699e248a2e2f71633183b61edb18094c1eb899c2a572014d4081525a4349d822e32c97ef80ba3be5287b475202578568cbf97280908f5

Download Submit
C:\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll

Filesize
711KB

MD5
8029d3733e6148ef569ae3fb2f27a205

SHA1
61b763a7ee5893f8a0a8e0a0c291453361c31702

SHA256
6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

SHA512
535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
585734b292bcaeec61fb037dd3e085e4

SHA1
d4322134e8e45e517e525563c15f5472bdeb6422

SHA256
7ec5186cad5f78f2d054a2a8de51beebf2f64e731e6e9f9e33042a0b6767f70c

SHA512
fa628ef2c73cb0663afb2b0f854b58960a75beaef66a5150da891f1ddf645b823abc32d63872412f449b43e05e03b8bd74fae49054ccd98c4fc34a96fb84da0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
746ab5be3b72b373a7cc0f8542a8997e

SHA1
a20b5c7cb5e0e908ddefa85d28864f555513e5b2

SHA256
bd80a53946f2e0e10d08b2c528eacf36f59aa5c36534602bb1eafcd0721c681e

SHA512
42d58e038bbeb26133d74a26b06ff6b8b4bab21f6c37491c277502e0d134b5758fa4d645309d374f7f2b01a616450e038a3257f9f78aaac173cfa7ab5fa6143b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\[email protected]\install.rdf

Filesize
593B

MD5
ebeeeb110190961362c831827358ca15

SHA1
1d337db47f6f3c5a87caad3e1f1df4bc3c1b412d

SHA256
7e1b5a620a8d289c04a87e92504966c4639aa61d1ebca31c50b60ada7869af4f

SHA512
d28ef30774742ffa6a44c7c67f868cbc4d5c44da24067f1cb1099c21edd398970c88ff330e78ba7a1a9764b0ae8da91045632c18c2b47e30b5aae6d7815b02ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\SdSvDCrZnIE9hHl.dat

Filesize
5KB

MD5
dcd169d93141fdc6fc8b09ee608d8099

SHA1
ce78788410bf274c6898e4dda7e662d404a7ac49

SHA256
57e444afc352c0c915ac5e14eeea2b6eb490b9462c290df471fb62e04f803fb9

SHA512
27347102e8c6c24bf1e699e248a2e2f71633183b61edb18094c1eb899c2a572014d4081525a4349d822e32c97ef80ba3be5287b475202578568cbf97280908f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\SdSvDCrZnIE9hHl.exe

Filesize
627KB

MD5
f172b0682fca8eb1e5c8dde6b837e387

SHA1
06561c1d33f425af65373cfd7752681edd356890

SHA256
ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e

SHA512
0d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\SdSvDCrZnIE9hHl.exe

Filesize
627KB

MD5
f172b0682fca8eb1e5c8dde6b837e387

SHA1
06561c1d33f425af65373cfd7752681edd356890

SHA256
ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e

SHA512
0d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\bgnjaboilapokahgiljjclmpneholimm\background.html

Filesize
140B

MD5
bac5ceba4f36821a3bf7bae005e0d100

SHA1
d82f1a13b930375edd792ae292add9588f9d87ea

SHA256
20b4669131ff04727524df517544baada54f125260215ee98f5020f0f5e1d1c4

SHA512
fcfcbe32f8c1e19e3b4135223ad60833b485d72df869304b683203426f4204ac6a4b6ce55a13f805bc89dfa7296f40137d9ef959c61c9c564e3ca8a04879ae9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\bgnjaboilapokahgiljjclmpneholimm\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\bgnjaboilapokahgiljjclmpneholimm\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\bgnjaboilapokahgiljjclmpneholimm\manifest.json

Filesize
498B

MD5
640199ea4621e34510de919f6a54436f

SHA1
dc65dbfad02bd2688030bd56ca1cab85917a9937

SHA256
e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

SHA512
d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\bgnjaboilapokahgiljjclmpneholimm\pfR.js

Filesize
5KB

MD5
41f62ef0dfabe62925cebc903a1fc189

SHA1
20d1a68eedd9fe19fae5f4a4b8ee0115a15b88ae

SHA256
58a916dd529d4c6790a7ec4ab63c9c924dd3d1517915f9ee772810c1fd4a9cff

SHA512
e41a0caec5050b31f07537742a82ae5b7c640d01dd80cdba7e92046e873ecdd22605829617b28edd86a91d9db1d5aa114237e28dc176da20fcae453e8e2da6ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\notLZBuW6mLiLj.dll

Filesize
627KB

MD5
ef0e781558e928c2959189bfd10fb730

SHA1
48231fa33eeb062e3e610c442bd5065a2f452ca6

SHA256
b9e3d582ec3ff1cdb0bca396cfa19a66469a8b05576bf6af51b12d91b2b64586

SHA512
679f07f56c98c800336ed312672dde579c3c17c6ae78e5a3df1b160d872ce2234426bbc3f144a2c0336c1e95cc6de6da466b5f579229748a39b7a3a0e4a6e802

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\notLZBuW6mLiLj.tlb

Filesize
3KB

MD5
ca7a16e39808f225fbd1abd72fdf15b2

SHA1
a256de866b7b53a8124c487a496bfc5c31d83998

SHA256
b85b955b7f1a0de04289a427bc1fef945c9c203a1c5715b1fdd7b2703b424260

SHA512
b534df49d91f5e68961d3aecd44a0ef404244b7e7ff7bca5a9cb910f1de366272ba34a4a11bf4c691ee4d8f0f155a6f4f2b57781ecbea6cc4646d32907a1afcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2953.tmp\notLZBuW6mLiLj.x64.dll

Filesize
711KB

MD5
8029d3733e6148ef569ae3fb2f27a205

SHA1
61b763a7ee5893f8a0a8e0a0c291453361c31702

SHA256
6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

SHA512
535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

Download Submit
\Program Files (x86)\GoSave\notLZBuW6mLiLj.dll

Filesize
627KB

MD5
ef0e781558e928c2959189bfd10fb730

SHA1
48231fa33eeb062e3e610c442bd5065a2f452ca6

SHA256
b9e3d582ec3ff1cdb0bca396cfa19a66469a8b05576bf6af51b12d91b2b64586

SHA512
679f07f56c98c800336ed312672dde579c3c17c6ae78e5a3df1b160d872ce2234426bbc3f144a2c0336c1e95cc6de6da466b5f579229748a39b7a3a0e4a6e802

Download Submit
\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll

Filesize
711KB

MD5
8029d3733e6148ef569ae3fb2f27a205

SHA1
61b763a7ee5893f8a0a8e0a0c291453361c31702

SHA256
6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

SHA512
535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

Download Submit
\Program Files (x86)\GoSave\notLZBuW6mLiLj.x64.dll

Filesize
711KB

MD5
8029d3733e6148ef569ae3fb2f27a205

SHA1
61b763a7ee5893f8a0a8e0a0c291453361c31702

SHA256
6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

SHA512
535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2953.tmp\SdSvDCrZnIE9hHl.exe

Filesize
627KB

MD5
f172b0682fca8eb1e5c8dde6b837e387

SHA1
06561c1d33f425af65373cfd7752681edd356890

SHA256
ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e

SHA512
0d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012

Download Submit
memory/1508-78-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Filesize
8KB

Download
memory/1596-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download