Analysis
-
max time kernel
46s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 06:35
Static task
static1
Behavioral task
behavioral1
Sample
32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe
Resource
win7-20220901-en
General
-
Target
32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe
-
Size
2.1MB
-
MD5
83bbd13eea5a5b7eaf54d68560f772bc
-
SHA1
5d06bd1cfe59246760786931d6448988f76767cd
-
SHA256
32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072
-
SHA512
3163edc94827d012e8d9106b87e2749b7d4adf9f36ad1a83f49fbfa8cc12714cbcf7ebda5f119fc03e2d5d6e9034684ff6a80c72131dc76ad6df14cec9a92a75
-
SSDEEP
49152:h1OsJNQToNVxbNrInKtDSwSm7CXH9e7RSlSAn5RjFdzgD20XrXTU:h1OINQUNVxNpSmGX9FdsD20Xs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Pb4GHa2Q0vjllDJ.exepid process 1148 Pb4GHa2Q0vjllDJ.exe -
Loads dropped DLL 4 IoCs
Processes:
32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exePb4GHa2Q0vjllDJ.exeregsvr32.exeregsvr32.exepid process 852 32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe 1148 Pb4GHa2Q0vjllDJ.exe 760 regsvr32.exe 1580 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
Pb4GHa2Q0vjllDJ.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eekkckdiehfhfhbikckkfhafejhclpcc\2.0\manifest.json Pb4GHa2Q0vjllDJ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eekkckdiehfhfhbikckkfhafejhclpcc\2.0\manifest.json Pb4GHa2Q0vjllDJ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eekkckdiehfhfhbikckkfhafejhclpcc\2.0\manifest.json Pb4GHa2Q0vjllDJ.exe -
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
Pb4GHa2Q0vjllDJ.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} Pb4GHa2Q0vjllDJ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} Pb4GHa2Q0vjllDJ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects Pb4GHa2Q0vjllDJ.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ Pb4GHa2Q0vjllDJ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} Pb4GHa2Q0vjllDJ.exe -
Drops file in Program Files directory 8 IoCs
Processes:
Pb4GHa2Q0vjllDJ.exedescription ioc process File created C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.dll Pb4GHa2Q0vjllDJ.exe File opened for modification C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.dll Pb4GHa2Q0vjllDJ.exe File created C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.tlb Pb4GHa2Q0vjllDJ.exe File opened for modification C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.tlb Pb4GHa2Q0vjllDJ.exe File created C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.dat Pb4GHa2Q0vjllDJ.exe File opened for modification C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.dat Pb4GHa2Q0vjllDJ.exe File created C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dll Pb4GHa2Q0vjllDJ.exe File opened for modification C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dll Pb4GHa2Q0vjllDJ.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Pb4GHa2Q0vjllDJ.exepid process 1148 Pb4GHa2Q0vjllDJ.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exePb4GHa2Q0vjllDJ.exeregsvr32.exedescription pid process target process PID 852 wrote to memory of 1148 852 32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe Pb4GHa2Q0vjllDJ.exe PID 852 wrote to memory of 1148 852 32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe Pb4GHa2Q0vjllDJ.exe PID 852 wrote to memory of 1148 852 32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe Pb4GHa2Q0vjllDJ.exe PID 852 wrote to memory of 1148 852 32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe Pb4GHa2Q0vjllDJ.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 1148 wrote to memory of 760 1148 Pb4GHa2Q0vjllDJ.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1580 760 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe"C:\Users\Admin\AppData\Local\Temp\32c572cacf0d5760729326fa9d29f20b06a03cbac5f94e54f39464d0d5ef9072.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\Pb4GHa2Q0vjllDJ.exe.\Pb4GHa2Q0vjllDJ.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.datFilesize
6KB
MD55b4b33da96e99a2ebe753db2aaada98e
SHA1bb1885eabe9ba0ce27c0f5335944dede7bc4ecf2
SHA2567e644cc794ca5c6df416a68b0032ed8ea6982df4766e1f8ba4cf7cafb2b51007
SHA512086a4ff69d4c00e3e78f83c9b8ae53fae93f9c81c87525e0cba588982b54d000034bb7b8ba0a93b14f0906343bf55d54eb22f4cb72b8aee12bf4c7549c7a3b36
-
C:\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dllFilesize
681KB
MD5e9475db8431e218fb9e93001a029d450
SHA165c9d72f51edaedad5ad5b644578f8f25da68bd0
SHA25633a7d43f85d41bea61dd46a31d911f1762c945ca031e62d57195f50caa7eb8ea
SHA5127d19e936ae4227c786dacda35a1bd4bd94a3147403ec04cc4d12ca4af2386e9cb17c6c3000e0360ea5d258ddd0a842d2044e80ddcce4d7117c2b94b0c43bdb11
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\NDPwD2aBQheWgX.dllFilesize
549KB
MD5aa482eddd64245769b9350f18fb48387
SHA10a78b93b628153ba6c133d3de6c2c28570822b20
SHA256fb4f5650fed042fc66d19ff0e6126fca8e078542820c24d21fdefb561a55bee8
SHA512849c02dae5ffd6bb2cec1f6927988ecbb536bb879063efdebaf687ee655e9af21d16d3eb12308f470d50d50edc86c7e93901ad77a05ac19d9f1219098b711120
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\NDPwD2aBQheWgX.tlbFilesize
3KB
MD5cf57859d4870e1907e52503d4ffcbb7c
SHA1fb0b87195347f8274e3fa046e0a34c3e57ff1e35
SHA256273641220fdd65602a2c7034d5365af6fae6fdf5dd78a3f9a0d7c773f4ee7e40
SHA512955523e6e85438857bddcb7be29f675643855f28ef3600e8b93e6dbb94c5ae961c0dd0f68cb2ae351df52843ccdf919aeb2b62be711180379617fa9b9463f394
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\NDPwD2aBQheWgX.x64.dllFilesize
681KB
MD5e9475db8431e218fb9e93001a029d450
SHA165c9d72f51edaedad5ad5b644578f8f25da68bd0
SHA25633a7d43f85d41bea61dd46a31d911f1762c945ca031e62d57195f50caa7eb8ea
SHA5127d19e936ae4227c786dacda35a1bd4bd94a3147403ec04cc4d12ca4af2386e9cb17c6c3000e0360ea5d258ddd0a842d2044e80ddcce4d7117c2b94b0c43bdb11
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\Pb4GHa2Q0vjllDJ.datFilesize
6KB
MD55b4b33da96e99a2ebe753db2aaada98e
SHA1bb1885eabe9ba0ce27c0f5335944dede7bc4ecf2
SHA2567e644cc794ca5c6df416a68b0032ed8ea6982df4766e1f8ba4cf7cafb2b51007
SHA512086a4ff69d4c00e3e78f83c9b8ae53fae93f9c81c87525e0cba588982b54d000034bb7b8ba0a93b14f0906343bf55d54eb22f4cb72b8aee12bf4c7549c7a3b36
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\Pb4GHa2Q0vjllDJ.exeFilesize
766KB
MD5eb843f08b06cc5bb0e8bbe9f8aaa0ba6
SHA10813518ec2daeb0a49d7ee2c9482150cc0eb1136
SHA2561d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
SHA51248e3ec76eeb7a54d7ae467317d03ad5f073249e38cb8be1f08a65d31c8c4fb687d8315d6093074c074fb16c782ca57f9d0ec53464d91c0998d85f54fe58324c4
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\Pb4GHa2Q0vjllDJ.exeFilesize
766KB
MD5eb843f08b06cc5bb0e8bbe9f8aaa0ba6
SHA10813518ec2daeb0a49d7ee2c9482150cc0eb1136
SHA2561d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
SHA51248e3ec76eeb7a54d7ae467317d03ad5f073249e38cb8be1f08a65d31c8c4fb687d8315d6093074c074fb16c782ca57f9d0ec53464d91c0998d85f54fe58324c4
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\eekkckdiehfhfhbikckkfhafejhclpcc\background.htmlFilesize
140B
MD5a8b66a7bbed0c4264b19284530d4dab0
SHA15640ed2b1c7f5bc7c4fd710a53bdf759e54b0f78
SHA2566a3ba2f98929f8a8d41cd1d2a717d26add95544076f2a956150b74baaee815bf
SHA5123a25d6f3dda98a2dac29e5ea7a25db37dbb67db0eaccfb7617d034c6158dd7843b1dc206c03bc60ad2828d5eea9ab5554882dcf05d89a647f4d42a96bdfa321c
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\eekkckdiehfhfhbikckkfhafejhclpcc\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\eekkckdiehfhfhbikckkfhafejhclpcc\k97.jsFilesize
5KB
MD5a29597fc263077d56fd520af310b489a
SHA19dc34bf2c5c8ba61605aec0d707c65956a374a4d
SHA2567c7ad4e00b930cad69f103c734e7edfca2f695562c7fe1978452b05ee5f9d0b2
SHA51231d54028b5f8fa49cfc9ca8deb0b353356330a467a83c05e7973dbc4ae5af4256ff774ad143d818b4c992067d02da0885c801f8028408b55f2dbf0c8aab698bb
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\eekkckdiehfhfhbikckkfhafejhclpcc\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\eekkckdiehfhfhbikckkfhafejhclpcc\manifest.jsonFilesize
502B
MD5cc9c40495fbb55ae62db958f436c5c1d
SHA15e9e1274dea5539252b3f74cea9d0fdbb32bf815
SHA256aac1e8d1eb18ede3b96714023ee0d9d47a8057f7a46e5c3ac73df1bb31aa5253
SHA512afd19c3190d9481e3fc72a87a50cdeb2aa7bb18ec07e0931b5381d1246b5a4e677f006e8b2e64a9a722210342c74ee50af8328df24864b2d36832ebdde9579bb
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\gu@mxL9WLb.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\gu@mxL9WLb.net\chrome.manifestFilesize
35B
MD5905121f35c99f57498f1820e45317702
SHA163bed7ac15a33ce80355dac7cd89be9e86e7c0bb
SHA256372c2862bd80e212cc34320042ac70cbc6a72e5f64482fee0513bf29cb5ddf9d
SHA512fba18ea251af848a3bdd61fc334184c9968e4bbd7eba00ef2c41aff3d41a91d787fea36a9dab3ee2dd4bc4f9f7b7030e5bc1775f5efebea327036748cc3d67b5
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\gu@mxL9WLb.net\content\bg.jsFilesize
7KB
MD5fb79df79825fdedf280636c51c600e67
SHA11302865435582de912b6fab72b85c2feb9450992
SHA25617cd4701bc59c9939023284460d4ff19860bc6b236dc0f1871d78894ebb5e856
SHA51237d81a470bdc562441813621dd7b9e959204b290eae98a365858be235b718871b60f6b2f8ca56db23a14c075c6c25a91e8975f13f7e846c9bf2d0a24bbbe6222
-
C:\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\gu@mxL9WLb.net\install.rdfFilesize
600B
MD5725cf4c1e3207ab2bf402d3b478a5820
SHA192e42baca2bfd0aab32589ffe7ad82e0aa8fb3f4
SHA25606725295d0a56981654802d4e825721cee962fe9c03227bec4b142e5a76a0ca5
SHA51202284d9df3960cf61500c4ab564402281764827cb0a0d9d403975b3fbc1b303dc16546945e979ba51b6c328026a806abfa455e873cac27fb3611622ce182cc7d
-
\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.dllFilesize
549KB
MD5aa482eddd64245769b9350f18fb48387
SHA10a78b93b628153ba6c133d3de6c2c28570822b20
SHA256fb4f5650fed042fc66d19ff0e6126fca8e078542820c24d21fdefb561a55bee8
SHA512849c02dae5ffd6bb2cec1f6927988ecbb536bb879063efdebaf687ee655e9af21d16d3eb12308f470d50d50edc86c7e93901ad77a05ac19d9f1219098b711120
-
\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dllFilesize
681KB
MD5e9475db8431e218fb9e93001a029d450
SHA165c9d72f51edaedad5ad5b644578f8f25da68bd0
SHA25633a7d43f85d41bea61dd46a31d911f1762c945ca031e62d57195f50caa7eb8ea
SHA5127d19e936ae4227c786dacda35a1bd4bd94a3147403ec04cc4d12ca4af2386e9cb17c6c3000e0360ea5d258ddd0a842d2044e80ddcce4d7117c2b94b0c43bdb11
-
\Program Files (x86)\PriceChOpo\NDPwD2aBQheWgX.x64.dllFilesize
681KB
MD5e9475db8431e218fb9e93001a029d450
SHA165c9d72f51edaedad5ad5b644578f8f25da68bd0
SHA25633a7d43f85d41bea61dd46a31d911f1762c945ca031e62d57195f50caa7eb8ea
SHA5127d19e936ae4227c786dacda35a1bd4bd94a3147403ec04cc4d12ca4af2386e9cb17c6c3000e0360ea5d258ddd0a842d2044e80ddcce4d7117c2b94b0c43bdb11
-
\Users\Admin\AppData\Local\Temp\7zS2CF.tmp\Pb4GHa2Q0vjllDJ.exeFilesize
766KB
MD5eb843f08b06cc5bb0e8bbe9f8aaa0ba6
SHA10813518ec2daeb0a49d7ee2c9482150cc0eb1136
SHA2561d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
SHA51248e3ec76eeb7a54d7ae467317d03ad5f073249e38cb8be1f08a65d31c8c4fb687d8315d6093074c074fb16c782ca57f9d0ec53464d91c0998d85f54fe58324c4
-
memory/760-73-0x0000000000000000-mapping.dmp
-
memory/852-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1148-56-0x0000000000000000-mapping.dmp
-
memory/1580-77-0x0000000000000000-mapping.dmp
-
memory/1580-78-0x000007FEFB651000-0x000007FEFB653000-memory.dmpFilesize
8KB