6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf

General

Target

6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe
Size

182KB
MD5

19e13740b772bc759f9a1b5366ea1f34
SHA1

c5c8d2ba30ceaf20571c4eac828e41ef0965f297
SHA256

6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf
SHA512

0f7c21ead099a2956785458268d3841c8fa83bc2b9fa2e3d34553cd6c98b07211a76cc003af27a1bbb3a14859f6c3184d554fb6681a08a9f19a5534ae6acb57f
SSDEEP

3072:I+RJBV2575eusnu4JuiTPqsn9pKZLR/M4U9bVmFBYySf/45IQRRoMwMUe3:IYJ32/rgJuimmqLRU4okFtSi3sM9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	toolbar.exe

Loads dropped DLL 2 IoCs

pid	Process
1952	6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe
1952	6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	toolbar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemScript = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\toolbar.exe\""	toolbar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	toolbar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemScript = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\toolbar.exe\""	toolbar.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlgdemkdapolikbjimjajpmonpbpmipk\1.0_0\manifest.json	toolbar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
544	toolbar.exe
544	toolbar.exe
544	toolbar.exe
544	toolbar.exe
544	toolbar.exe
544	toolbar.exe
544	toolbar.exe
544	toolbar.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 544	1952	6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe	28
PID 1952 wrote to memory of 544	1952	6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe	28
PID 1952 wrote to memory of 544	1952	6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe	28
PID 1952 wrote to memory of 544	1952	6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe	28
PID 544 wrote to memory of 2036	544	toolbar.exe	29
PID 544 wrote to memory of 2036	544	toolbar.exe	29
PID 544 wrote to memory of 2036	544	toolbar.exe	29
PID 544 wrote to memory of 2036	544	toolbar.exe	29
PID 544 wrote to memory of 268	544	toolbar.exe	31
PID 544 wrote to memory of 268	544	toolbar.exe	31
PID 544 wrote to memory of 268	544	toolbar.exe	31
PID 544 wrote to memory of 268	544	toolbar.exe	31

C:\Users\Admin\AppData\Local\Temp\6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe
"C:\Users\Admin\AppData\Local\Temp\6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Microsoft\Windows\toolbar.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\toolbar.exe" lol
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops Chrome extension
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /tn SystemScript /f
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /tn SystemScript /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\toolbar.exe"" /sc ONLOGON /f
    3⤵
    - Creates scheduled task(s)
    PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\toolbar.exe

Filesize
182KB

MD5
19e13740b772bc759f9a1b5366ea1f34

SHA1
c5c8d2ba30ceaf20571c4eac828e41ef0965f297

SHA256
6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf

SHA512
0f7c21ead099a2956785458268d3841c8fa83bc2b9fa2e3d34553cd6c98b07211a76cc003af27a1bbb3a14859f6c3184d554fb6681a08a9f19a5534ae6acb57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\windows.zpx

Filesize
104KB

MD5
6f806b5954d057b8beb4fa9407885a07

SHA1
ebee7cfe3227e702b5dd337d1ba2400f0e5e88b7

SHA256
706dc075630b4a171df48d7de2b9bf268110616d1ed6cb485dfd988ba7235135

SHA512
ba0447f55779e6bf16fd5cf876d2cbfd1a5b7c5f2dc82c42d1d669d04ff242e6266fd135a70e48c0f1945aee7680359b26d5b5d1038e0564ffc1b54ce690d3de

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\toolbar.exe

Filesize
182KB

MD5
19e13740b772bc759f9a1b5366ea1f34

SHA1
c5c8d2ba30ceaf20571c4eac828e41ef0965f297

SHA256
6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf

SHA512
0f7c21ead099a2956785458268d3841c8fa83bc2b9fa2e3d34553cd6c98b07211a76cc003af27a1bbb3a14859f6c3184d554fb6681a08a9f19a5534ae6acb57f

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\toolbar.exe

Filesize
182KB

MD5
19e13740b772bc759f9a1b5366ea1f34

SHA1
c5c8d2ba30ceaf20571c4eac828e41ef0965f297

SHA256
6b968fba3ba74a04e1f1d9b82836d228e874ed76225f744f23d2dfabd0f32bcf

SHA512
0f7c21ead099a2956785458268d3841c8fa83bc2b9fa2e3d34553cd6c98b07211a76cc003af27a1bbb3a14859f6c3184d554fb6681a08a9f19a5534ae6acb57f

Download Submit
memory/1952-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads