Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 06:54
Static task
static1
Behavioral task
behavioral1
Sample
15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe
Resource
win7-20221111-en
General
-
Target
15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe
-
Size
2.0MB
-
MD5
9e59b60f76830d7ae3c4ecf37f1e206b
-
SHA1
4309891de0603a73e060992e0680de88c6c50dd6
-
SHA256
15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402
-
SHA512
4b25da6c229047f27cbe58db6b1c9c280b746c3da48b1bc0d1d481da2a5a212ae57aaf4dcd8e84f3072c0941d4ba603f9b7f59fb419a2231573e25e15949e157
-
SSDEEP
49152:h1OsyNQToNVxbNrInKtDSwSm7CXH9e7B6cr7J30Ct40pT6:h1OfNQUNVxNpSmGXMvxdt+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pSWbkar6M58gQhl.exepid process 3100 pSWbkar6M58gQhl.exe -
Loads dropped DLL 3 IoCs
Processes:
pSWbkar6M58gQhl.exeregsvr32.exeregsvr32.exepid process 3100 pSWbkar6M58gQhl.exe 4796 regsvr32.exe 3488 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
pSWbkar6M58gQhl.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfcbecjdpihfdfmpekfclpecnjdickdm\1.3\manifest.json pSWbkar6M58gQhl.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfcbecjdpihfdfmpekfclpecnjdickdm\1.3\manifest.json pSWbkar6M58gQhl.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfcbecjdpihfdfmpekfclpecnjdickdm\1.3\manifest.json pSWbkar6M58gQhl.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfcbecjdpihfdfmpekfclpecnjdickdm\1.3\manifest.json pSWbkar6M58gQhl.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfcbecjdpihfdfmpekfclpecnjdickdm\1.3\manifest.json pSWbkar6M58gQhl.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exepSWbkar6M58gQhl.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} pSWbkar6M58gQhl.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects pSWbkar6M58gQhl.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} pSWbkar6M58gQhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ pSWbkar6M58gQhl.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
pSWbkar6M58gQhl.exedescription ioc process File opened for modification C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.dll pSWbkar6M58gQhl.exe File created C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.tlb pSWbkar6M58gQhl.exe File opened for modification C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.tlb pSWbkar6M58gQhl.exe File created C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.dat pSWbkar6M58gQhl.exe File opened for modification C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.dat pSWbkar6M58gQhl.exe File created C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dll pSWbkar6M58gQhl.exe File opened for modification C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dll pSWbkar6M58gQhl.exe File created C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.dll pSWbkar6M58gQhl.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pSWbkar6M58gQhl.exepid process 3100 pSWbkar6M58gQhl.exe 3100 pSWbkar6M58gQhl.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exepSWbkar6M58gQhl.exeregsvr32.exedescription pid process target process PID 4456 wrote to memory of 3100 4456 15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe pSWbkar6M58gQhl.exe PID 4456 wrote to memory of 3100 4456 15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe pSWbkar6M58gQhl.exe PID 4456 wrote to memory of 3100 4456 15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe pSWbkar6M58gQhl.exe PID 3100 wrote to memory of 4796 3100 pSWbkar6M58gQhl.exe regsvr32.exe PID 3100 wrote to memory of 4796 3100 pSWbkar6M58gQhl.exe regsvr32.exe PID 3100 wrote to memory of 4796 3100 pSWbkar6M58gQhl.exe regsvr32.exe PID 4796 wrote to memory of 3488 4796 regsvr32.exe regsvr32.exe PID 4796 wrote to memory of 3488 4796 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe"C:\Users\Admin\AppData\Local\Temp\15c03db8ba69a7f0d0d6ae6cab036dc6f5ec0ece5029742c8d1e64effc280402.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\pSWbkar6M58gQhl.exe.\pSWbkar6M58gQhl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.datFilesize
6KB
MD5a7527a0184ee95c27a586e8af88c3c15
SHA1b1c96314859fa75e32abe770016ac6b636b61606
SHA2567b2e25515b5df8e8417b5dbcc91c0501c846ed73449a31220e153a88082fd9e0
SHA512fa48cb93171f732f7e06ead83cd31f8584682510e708e85839552a7efeb83683d17b374a95c5f9747f3a225fe6959bc17e561abcdc261debe2808eb49378ad89
-
C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.dllFilesize
500KB
MD57e61fef6948fc1aa1cb31d42b274cefb
SHA1bff9450ed225c31548426c98ebcf6055ba7a2bb9
SHA25605166d95acb90a6b9a539ef9aa864b86affc1099249dd1fda6e19ff88496ced9
SHA512e48341eefdee739038faef21d1534d107635835540615f703f3f043ce7fc53f3c799f05edfe10571f2f0fd4174783007e57b47294b267224a42ea8c7fae61c0c
-
C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dllFilesize
639KB
MD5388feac0c3abaf35d451edd34e89b2d4
SHA1564e5f05143e29e5de4f202dd9c6f36b05b3bcb3
SHA25680df3798ceffbe51714b7c4ff96ea22847e9c1f1d4f278ec56396635cde59acd
SHA51259c4fb9c41dbbeb824778e8f65da39a84d80c9eeab96be5d0255f6d0a53a4eb94901335fb263d2ee38ab764fcd95def701c398603d5aba2e52337795af1cd210
-
C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dllFilesize
639KB
MD5388feac0c3abaf35d451edd34e89b2d4
SHA1564e5f05143e29e5de4f202dd9c6f36b05b3bcb3
SHA25680df3798ceffbe51714b7c4ff96ea22847e9c1f1d4f278ec56396635cde59acd
SHA51259c4fb9c41dbbeb824778e8f65da39a84d80c9eeab96be5d0255f6d0a53a4eb94901335fb263d2ee38ab764fcd95def701c398603d5aba2e52337795af1cd210
-
C:\Program Files (x86)\VaUdIx\w8E0PMLcMaB9p8.x64.dllFilesize
639KB
MD5388feac0c3abaf35d451edd34e89b2d4
SHA1564e5f05143e29e5de4f202dd9c6f36b05b3bcb3
SHA25680df3798ceffbe51714b7c4ff96ea22847e9c1f1d4f278ec56396635cde59acd
SHA51259c4fb9c41dbbeb824778e8f65da39a84d80c9eeab96be5d0255f6d0a53a4eb94901335fb263d2ee38ab764fcd95def701c398603d5aba2e52337795af1cd210
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\JtB@2MTSINe.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\JtB@2MTSINe.com\chrome.manifestFilesize
35B
MD504206da7ac8f8d5e81e8dc59655d7b2a
SHA12a5abda402a4b4a27a4f3e5902b203e8682576fc
SHA25628ad5d72016648f8ce9cc4d42a7c1be774d83b35b58678429478609847dcf9fc
SHA51234aecf1983a4daaf429b9fe4350d6433c44b09602c5ccdd656c9f0442ba4ecbf8bca807d96995236333b0daadd7226dbc14e73a37cc2877ed74fadfb7b22f363
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\JtB@2MTSINe.com\content\bg.jsFilesize
7KB
MD5f303cf698d54cb2465ad33bb8358b9f5
SHA155f721659e243f4fa42e1e95f747e426dcca1952
SHA256367ba7fcfe3b6d1ceabd5b1e384fc7329d37e9b69759333e63160071e4d7a316
SHA5124f7d3e2d2b1c11e8f52fa3890c916495b9797da00d65c192f3204ff8571b8c33ce59d3ff47989ea9934c3903081af0a0a891ae7e6663b26159528ecc9dc83251
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\JtB@2MTSINe.com\install.rdfFilesize
597B
MD56bc815e5362e33f1fec6f844b4c1c1db
SHA1c6428fc6b5f61b9b2ba663c6a85c3ae8a8c37244
SHA256902edd072880bb35526b8e70b9e36cd7c0ab04881503891957b3351443dd8e13
SHA5125e660a3948acabfa564977381bb8533aecf33d8d7970907fddc8eff73daa4b6f1cddace6689f4fc1967ff2655054b743fcf2b432db2baa3429d3607c26170acf
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\dfcbecjdpihfdfmpekfclpecnjdickdm\background.htmlFilesize
140B
MD5e9e8ba0e0972c9d5d8bb33b7f0cab097
SHA11b7673976240afc3028445339e5f087ec67dfe28
SHA2569d45b2343189d757c41e23a623e3c8f6a83d1c7e7e09e779f4b9958d98f0910b
SHA512f46a8ddce38fca0d32947df8691612f68f8faf4b82603c395125ce6453e3ba0a4fc135d52d750f3fbe1820555bbedb74dbed79aae76bc2692f39ede2eb1d5aa4
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\dfcbecjdpihfdfmpekfclpecnjdickdm\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\dfcbecjdpihfdfmpekfclpecnjdickdm\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\dfcbecjdpihfdfmpekfclpecnjdickdm\manifest.jsonFilesize
498B
MD58228aa9acd70401ac9d1caf6b13bfbc3
SHA11446b543105251c9fd00590b8ff71dcd7c7eb47b
SHA256d97cf3175e44e8afa1dd05c5859009c5437c62e126faecf2f41face6f4c620f2
SHA5121d90ba17693277a3f88c08db505faf370dadc378c714168d6a93d9e85dae8a3eee20b41a53fdf0f690ca69f51ca908ae74c2fa48f509ed40ad01f31b4ae9e13a
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\dfcbecjdpihfdfmpekfclpecnjdickdm\u1u.jsFilesize
5KB
MD5b28dd306d6d2e8ebe649c8c44a78b239
SHA18bb53fffa72036ff377a65c935e6f03331873e5e
SHA256de409e4039456ec80e8add8aada0748811911d4e5921d8d08db71a02f3f459da
SHA512064a60a75207e7ae0b3b89796954882ec740d28ad8d596aea85961fcc1e243bf05637a75cc5f36ce143be5cd562d8f2f818d5a8782b13d535caaf61c14091729
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\pSWbkar6M58gQhl.datFilesize
6KB
MD5a7527a0184ee95c27a586e8af88c3c15
SHA1b1c96314859fa75e32abe770016ac6b636b61606
SHA2567b2e25515b5df8e8417b5dbcc91c0501c846ed73449a31220e153a88082fd9e0
SHA512fa48cb93171f732f7e06ead83cd31f8584682510e708e85839552a7efeb83683d17b374a95c5f9747f3a225fe6959bc17e561abcdc261debe2808eb49378ad89
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\pSWbkar6M58gQhl.exeFilesize
766KB
MD5eb843f08b06cc5bb0e8bbe9f8aaa0ba6
SHA10813518ec2daeb0a49d7ee2c9482150cc0eb1136
SHA2561d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
SHA51248e3ec76eeb7a54d7ae467317d03ad5f073249e38cb8be1f08a65d31c8c4fb687d8315d6093074c074fb16c782ca57f9d0ec53464d91c0998d85f54fe58324c4
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\pSWbkar6M58gQhl.exeFilesize
766KB
MD5eb843f08b06cc5bb0e8bbe9f8aaa0ba6
SHA10813518ec2daeb0a49d7ee2c9482150cc0eb1136
SHA2561d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
SHA51248e3ec76eeb7a54d7ae467317d03ad5f073249e38cb8be1f08a65d31c8c4fb687d8315d6093074c074fb16c782ca57f9d0ec53464d91c0998d85f54fe58324c4
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\w8E0PMLcMaB9p8.dllFilesize
500KB
MD57e61fef6948fc1aa1cb31d42b274cefb
SHA1bff9450ed225c31548426c98ebcf6055ba7a2bb9
SHA25605166d95acb90a6b9a539ef9aa864b86affc1099249dd1fda6e19ff88496ced9
SHA512e48341eefdee739038faef21d1534d107635835540615f703f3f043ce7fc53f3c799f05edfe10571f2f0fd4174783007e57b47294b267224a42ea8c7fae61c0c
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\w8E0PMLcMaB9p8.tlbFilesize
3KB
MD5cf57859d4870e1907e52503d4ffcbb7c
SHA1fb0b87195347f8274e3fa046e0a34c3e57ff1e35
SHA256273641220fdd65602a2c7034d5365af6fae6fdf5dd78a3f9a0d7c773f4ee7e40
SHA512955523e6e85438857bddcb7be29f675643855f28ef3600e8b93e6dbb94c5ae961c0dd0f68cb2ae351df52843ccdf919aeb2b62be711180379617fa9b9463f394
-
C:\Users\Admin\AppData\Local\Temp\7zS618D.tmp\w8E0PMLcMaB9p8.x64.dllFilesize
639KB
MD5388feac0c3abaf35d451edd34e89b2d4
SHA1564e5f05143e29e5de4f202dd9c6f36b05b3bcb3
SHA25680df3798ceffbe51714b7c4ff96ea22847e9c1f1d4f278ec56396635cde59acd
SHA51259c4fb9c41dbbeb824778e8f65da39a84d80c9eeab96be5d0255f6d0a53a4eb94901335fb263d2ee38ab764fcd95def701c398603d5aba2e52337795af1cd210
-
memory/3100-132-0x0000000000000000-mapping.dmp
-
memory/3488-152-0x0000000000000000-mapping.dmp
-
memory/4796-149-0x0000000000000000-mapping.dmp