abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b

Analysis

max time kernel
141s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b.exe
Size

789KB
MD5

7c13e0c2d285a65041327587d8a4442d
SHA1

c2b8bb49bb9d37062151aec710f4d7a720888386
SHA256

abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b
SHA512

dc14de4c8589563a72e4d662b16a29cab6ba7c594d1b90c74902588d60ae783ab5abbd48c08827543eb97b01248dee2ec15772c8bd5491dec76973aa7d92d13f
SSDEEP

24576:h1OYdaOPwkBM0MlnPTdF7/c4TTLWEuhMR:h1Os1M1PrQiLDuiR

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2304	M38oNKgr0LNVl49.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eldemlpalljifnacjjdfhkcglhcbmgdn\2.0\manifest.json	M38oNKgr0LNVl49.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eldemlpalljifnacjjdfhkcglhcbmgdn\2.0\manifest.json	M38oNKgr0LNVl49.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eldemlpalljifnacjjdfhkcglhcbmgdn\2.0\manifest.json	M38oNKgr0LNVl49.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eldemlpalljifnacjjdfhkcglhcbmgdn\2.0\manifest.json	M38oNKgr0LNVl49.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\eldemlpalljifnacjjdfhkcglhcbmgdn\2.0\manifest.json	M38oNKgr0LNVl49.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	M38oNKgr0LNVl49.exe
File opened for modification	C:\Windows\System32\GroupPolicy	M38oNKgr0LNVl49.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	M38oNKgr0LNVl49.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	M38oNKgr0LNVl49.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2304	M38oNKgr0LNVl49.exe
2304	M38oNKgr0LNVl49.exe
2304	M38oNKgr0LNVl49.exe
2304	M38oNKgr0LNVl49.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2304	3028	abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b.exe	79
PID 3028 wrote to memory of 2304	3028	abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b.exe	79
PID 3028 wrote to memory of 2304	3028	abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b.exe	79

C:\Users\Admin\AppData\Local\Temp\abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b.exe
"C:\Users\Admin\AppData\Local\Temp\abf4fa2aef0f69a4bf14af84fa0c03444ba46de8a371b6cf5963e1cfa13ee58b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\M38oNKgr0LNVl49.exe
  .\M38oNKgr0LNVl49.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\M38oNKgr0LNVl49.dat

Filesize
1KB

MD5
f26a9a3ca13dd99dff6e30f39aa1f531

SHA1
061945b55b7a72d9c04ad40fa00c0f8907c3f89f

SHA256
979effba7f50f4154a1a6d48d35208e7391150a58863b0641d4568e826f1556b

SHA512
e83986ed1e288f759e8754adc83d5d471b366ec95a7bf4d0b7fc48fe11cacf08b5a215017d1dafceb8c7bbd6e2900cb21f11593044e343428e3cf38f15154959

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\M38oNKgr0LNVl49.exe

Filesize
631KB

MD5
8580d9d21b9f472b70bbc3a91b2dfb3b

SHA1
ec67fec4cecc50564c4c89db6c305b7c5dc8548e

SHA256
81d9ccdaefd6600fd727ca34ec858a126539e9204c0f842696b186b51ebc8fb0

SHA512
5af5106ebc64fc9df1d75b9f1045010ce60aaa706c5881bac28193dae5524ece55f81cba149076272a275535edab8f098920170f6a4554f92dd07b647f570948

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\M38oNKgr0LNVl49.exe

Filesize
631KB

MD5
8580d9d21b9f472b70bbc3a91b2dfb3b

SHA1
ec67fec4cecc50564c4c89db6c305b7c5dc8548e

SHA256
81d9ccdaefd6600fd727ca34ec858a126539e9204c0f842696b186b51ebc8fb0

SHA512
5af5106ebc64fc9df1d75b9f1045010ce60aaa706c5881bac28193dae5524ece55f81cba149076272a275535edab8f098920170f6a4554f92dd07b647f570948

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
a864f52a0078e2b26e27927295df6562

SHA1
008acc54fda57dd6a1f98fa0654df2006129327a

SHA256
80957baf6118936244d4a08f7513bb549506455dc75d5729de1eb82368b6e07d

SHA512
6068c95c14ad413f643664408b01cbf5d4ef4ab3fa70a5a64310c792d024c7f0358b71484de459fa8eb60b79d4559107ec060eb5a3bb01e7c08630731803cec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
36079331b19721e3fecf720216a38aa6

SHA1
a05e312e83e9a43da4bce6caff18fdd3e07557b8

SHA256
bf4031d0aad5ca2db216b0e35d279b8aa4ef02ceea1e571b53dd11bb471b6aa4

SHA512
d9585878d8bcf2a9f757210616110b0ed45337de5557cb9a40800251f9d8b416deb6e09835574b1e6f2b27c50b623e09155fe7cb8168b4d37868792e53e5e903

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\[email protected]\install.rdf

Filesize
595B

MD5
26766d499d6186f3b22dc94d74fc46b1

SHA1
a1d8faae1e487c5a02938ca2d954857fc01f0f8d

SHA256
4855faaec1b4ea025af4cf94897685e09483bb4c100879003ea96e45ae1269eb

SHA512
327f4362d54b530a433b9157306a6cb74330e2ea4107763b26e2a1a46e34f67ce2345a26dd7e39b7370afc40e0ebd85feac904a57f57535162bfaebb10f0da50

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\eldemlpalljifnacjjdfhkcglhcbmgdn\YRspMgy.js

Filesize
6KB

MD5
a243262e02aac64a6d99ba3984d9962d

SHA1
e67355c74956e95d3cef36ef84c409279249b25d

SHA256
bf1f873a38dd4d538ac7281593eacd82e99ddd6f51323239b0bbeb9247d71d06

SHA512
befd8f5ad17e448ec7739b136fb9206a49769ac5335bfaf4af2ef626b5241c5bab63f9062e204df564fce516fcc06dcd22ba6bd66ac942a3a6ce8fe502c84c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\eldemlpalljifnacjjdfhkcglhcbmgdn\background.html

Filesize
144B

MD5
2c3a702a4638c8a011438bca8f68d148

SHA1
54aec3320b47e9b5ce3a1506eba10deee0233cc6

SHA256
cbd4593c656eaf0e9c41f0da9319f4c5e4185bbac6bd02d667dbafab2199214b

SHA512
d4882a4a1855334ed514c8b7020c7a7f7335f5302988ab541a5bb52a6d6842943461f874f4a20b21deec53014b0d2a001b2232e884d5bd004ba387793ae907ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\eldemlpalljifnacjjdfhkcglhcbmgdn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\eldemlpalljifnacjjdfhkcglhcbmgdn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS92A0.tmp\eldemlpalljifnacjjdfhkcglhcbmgdn\manifest.json

Filesize
498B

MD5
5d8b560f900f00e62aa129f1fd677989

SHA1
50d03404e935374cada2779f89c33c096ce6fb80

SHA256
9427cc79b9bd56a0ce543ab1cbb63264be500e5596b91a387afa5b7bebabcca2

SHA512
3ed280bd8c5b377df319c09069efc8f17a873bc0cba878a835b1f61eb684594741538735ff6e43feb938778859aa19b4f9ce5cbaccdca0db1b4b54d6400cb7bc

Download Submit