e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe
Size

789KB
MD5

fc27327b2b4ce7737937876d4ac5c35e
SHA1

a834b025c706ca1ad6ffc2e3bfb3bfb1dbb7afa3
SHA256

e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191
SHA512

a748bccf137ff132d400788e60eec938066d80300b814385f62e1d47792bca581d25989313af4c8d45e4209f11f9fc1822c0575b8f11655ca116b9c6de24d02b
SSDEEP

24576:h1OYdaOXwkBM0MlnPTdF7/c4TTLWEuhM3:h1OspM1PrQiLDui3

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1524	TBXakH5w6n9ANlX.exe

Loads dropped DLL 1 IoCs

pid	Process
1328	e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\elpjepiampeiicdapnepjmffnajfafig\2.0\manifest.json	TBXakH5w6n9ANlX.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\elpjepiampeiicdapnepjmffnajfafig\2.0\manifest.json	TBXakH5w6n9ANlX.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\elpjepiampeiicdapnepjmffnajfafig\2.0\manifest.json	TBXakH5w6n9ANlX.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	TBXakH5w6n9ANlX.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	TBXakH5w6n9ANlX.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	TBXakH5w6n9ANlX.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	TBXakH5w6n9ANlX.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1524	TBXakH5w6n9ANlX.exe
1524	TBXakH5w6n9ANlX.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1524	1328	e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe	27
PID 1328 wrote to memory of 1524	1328	e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe	27
PID 1328 wrote to memory of 1524	1328	e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe	27
PID 1328 wrote to memory of 1524	1328	e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe	27

C:\Users\Admin\AppData\Local\Temp\e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe
"C:\Users\Admin\AppData\Local\Temp\e36906ebec191882493bcbc9836018496cc2ad5b287b2c6c3170a1f763c10191.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\TBXakH5w6n9ANlX.exe
  .\TBXakH5w6n9ANlX.exe
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\TBXakH5w6n9ANlX.dat

Filesize
1KB

MD5
0e7b8054a099b84b1230120f793d62fc

SHA1
d8414bad6bdfcb6b37ae121d9e3ca295422e4a6f

SHA256
81becea9626adea6ff077f6759300798e161d52f87d653a93a984456feb18455

SHA512
dbb9c13b3213ea43fe30cf458209d4cb17d5bec67ce9bd61d0983490dde7935b9b12a05e8cd8828b13e506144ee7c777ae4ad69fa8fd5edf699412c2450b5c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\TBXakH5w6n9ANlX.exe

Filesize
631KB

MD5
8580d9d21b9f472b70bbc3a91b2dfb3b

SHA1
ec67fec4cecc50564c4c89db6c305b7c5dc8548e

SHA256
81d9ccdaefd6600fd727ca34ec858a126539e9204c0f842696b186b51ebc8fb0

SHA512
5af5106ebc64fc9df1d75b9f1045010ce60aaa706c5881bac28193dae5524ece55f81cba149076272a275535edab8f098920170f6a4554f92dd07b647f570948

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
0bb434826033615265c8893f6ac5c73d

SHA1
73e6ffdf87bcc266a5fc5ba250c1ea83fd3d9768

SHA256
50ec694462d66fcf5634b32043883002325f7e1fbda047d2e76e773448d4c0a8

SHA512
b0edbb7360ea2a1890e0ed8e286aae7aefc05fd6b69e458bcb7b85beea1b4154c80a44074a5a2f5358baa17b77aac9735db200e44539a92c536aed93a8aae6c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
ee42783c38aeccccd759288d92a13701

SHA1
e862882f9c8c86dfa74b790a68fe98d29dcc0a47

SHA256
4acfa136804933f3142926dbc412d22d668a21b2542acbeefc8fecc6f311641f

SHA512
1cb1c9e5dd75b6e652bb41c1571317d10af3d2c97bffd06d7ebc9332991437ab53afd59744b8065297ef0148d587212af6d683cdf20917babc83ff261dcfeede

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\[email protected]\install.rdf

Filesize
592B

MD5
e55346e320102b7450ec06800668049a

SHA1
9d18e4633eb5f4ad7e7e623286d7ec3adfcc323d

SHA256
818d0526f2942a4f42e1f81925349bf4d90893d876f9a56ae7634aacbc425d70

SHA512
49b8f21eab27a0480f5149464ffbd55ecfd2ef3ca6ad5f112ec22cdc5a1166a03488f1aaf13452d2824441a579e3147b7bee5508f6fa1813083d13a153c85a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\elpjepiampeiicdapnepjmffnajfafig\KX.js

Filesize
6KB

MD5
cc3b33900e58871b6702a60183adc6db

SHA1
49df6a91c712168b96e1ec118940cff412ecde08

SHA256
c99265a9dda8e88bafac846f365b4e8ec59f0bbd17e30f3e2ca36d61c06c0606

SHA512
bda2072882972826b91bdd3513922b595dba46b4246e5b53b1c4390938c072d78c0e2d8449d2874a321236231c4e104133f18988694d2e51aca27321897aff5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\elpjepiampeiicdapnepjmffnajfafig\background.html

Filesize
139B

MD5
af891aa4987e79a847cd342ae0aa41f3

SHA1
aba53d6bc89c66e9f7b99e3d16efa4efe6b36948

SHA256
3e28ae85a014fad3e751dc369eaae04ba4073d4d028903d7c28b11177f94a00f

SHA512
35fb0d09d75502aa832786ff620cfa3c6c94dd1fb2e14c84b86c344ecca845279711b4d9d0579837b90de2724b45535faf464ad803a7c2ab4eeb1b4c97842e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\elpjepiampeiicdapnepjmffnajfafig\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\elpjepiampeiicdapnepjmffnajfafig\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\elpjepiampeiicdapnepjmffnajfafig\manifest.json

Filesize
498B

MD5
89a241d9a52cb219f29cebedc468a56c

SHA1
32d0c1c01e5edcd477ab02fe1ea66ee36f3edd66

SHA256
3e1d41b33440994a6f512014f98fae28bd40b625a2bc80f16290cf8a961fd4a8

SHA512
cc783a38629e69e98f45d4bbc69e6cad70b59caf7886b95aefc6b564be79730d7bd7c4268e20c2be8bc3e3073ecb0c2eed584c7226b95f9707661c82fc7455be

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1A45.tmp\TBXakH5w6n9ANlX.exe

Filesize
631KB

MD5
8580d9d21b9f472b70bbc3a91b2dfb3b

SHA1
ec67fec4cecc50564c4c89db6c305b7c5dc8548e

SHA256
81d9ccdaefd6600fd727ca34ec858a126539e9204c0f842696b186b51ebc8fb0

SHA512
5af5106ebc64fc9df1d75b9f1045010ce60aaa706c5881bac28193dae5524ece55f81cba149076272a275535edab8f098920170f6a4554f92dd07b647f570948

Download Submit
memory/1328-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download