Analysis
- max time kernel
103s - max time network
107s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
14/01/2023, 05:36
General
- Target abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
- Size 1.4MB
- Sample230114-gamzpsed21
- SHA256 abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a
Malware Config
Signatures
- Executes dropped EXE 40 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 29 IoCs
- Modifies data under HKEY_USERS 30 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe"C:\Users\Admin\AppData\Local\Temp\abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 284 -NGENProcess 280 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 284 -NGENProcess 280 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 298 -Pipe 2f8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2ec -NGENProcess 298 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 310 -NGENProcess 2e4 -Pipe 30c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 308 -NGENProcess 2f4 -Pipe 298 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 284 -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 280 -NGENProcess 2f4 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 318 -NGENProcess 290 -Pipe 314 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 318 -NGENProcess 280 -Pipe 2fc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 320 -NGENProcess 290 -Pipe 304 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 320 -NGENProcess 318 -Pipe 2ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 29c -NGENProcess 320 -Pipe 318 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 328 -NGENProcess 1c0 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 340 -NGENProcess 32c -Pipe 33c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 338 -NGENProcess 334 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 344 -NGENProcess 2e4 -Pipe 330 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 32c -Pipe 2f4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 354 -NGENProcess 334 -Pipe 350 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 234 -Pipe 34c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 364 -NGENProcess 32c -Pipe 360 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 394 -NGENProcess 338 -Pipe 390 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 384 -Pipe 38c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 1c8 -NGENProcess 1cc -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
OSE.EXE
GROOVE.EXE
maintenanceservice.exe
OSPPSVC.EXE
elevation_service.exe
mscorsvw.exe
mscorsvw.exe
aspnet_state.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
mscorsvw.exe
638c4bf533ead630.bin
alg.exe
dllhost.exe
ehrecvr.exe
ehsched.exe
elevation_service.exe
mscorsvw.exe
aspnet_state.exe
alg.exe
dllhost.exe
ehrecvr.exe
ehsched.exe
memory/428-104-0x0000000000350000-0x00000000003B7000-memory.dmp
memory/428-102-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/428-80-0x0000000000350000-0x00000000003B7000-memory.dmp
memory/536-54-0x0000000076871000-0x0000000076873000-memory.dmp
memory/536-127-0x0000000000400000-0x000000000058B000-memory.dmp
memory/536-55-0x0000000001E70000-0x0000000001ED7000-memory.dmp
memory/536-65-0x0000000000400000-0x000000000058B000-memory.dmp
memory/536-66-0x0000000001E70000-0x0000000001ED7000-memory.dmp
memory/584-100-0x0000000140000000-0x00000001401ED000-memory.dmp
memory/584-106-0x0000000000330000-0x0000000000390000-memory.dmp
memory/584-88-0x0000000000330000-0x0000000000390000-memory.dmp
memory/592-136-0x00000000004B0000-0x0000000000510000-memory.dmp
memory/592-154-0x00000000004B0000-0x0000000000510000-memory.dmp
memory/592-152-0x0000000140000000-0x000000014020E000-memory.dmp
memory/976-122-0x0000000001380000-0x0000000001390000-memory.dmp
memory/976-112-0x0000000000870000-0x00000000008D0000-memory.dmp
memory/976-126-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/976-128-0x0000000140000000-0x000000014013C000-memory.dmp
memory/976-130-0x0000000000870000-0x00000000008D0000-memory.dmp
memory/1124-133-0x0000000140000000-0x00000001401F1000-memory.dmp
memory/1124-150-0x0000000000820000-0x0000000000880000-memory.dmp
memory/1124-120-0x0000000000820000-0x0000000000880000-memory.dmp
memory/1220-182-0x0000000000160000-0x00000000001C0000-memory.dmp
memory/1220-183-0x0000000100000000-0x0000000100542000-memory.dmp
memory/1220-181-0x0000000100000000-0x0000000100542000-memory.dmp
memory/1220-191-0x0000000074A98000-0x0000000074AAD000-memory.dmp
memory/1284-170-0x0000000000A30000-0x0000000000A90000-memory.dmp
memory/1284-171-0x0000000140000000-0x000000014020E000-memory.dmp
memory/1284-157-0x0000000000A30000-0x0000000000A90000-memory.dmp
memory/1476-85-0x0000000010000000-0x00000000101E6000-memory.dmp
memory/1544-101-0x00000000008A0000-0x0000000000900000-memory.dmp
memory/1544-124-0x00000000008A0000-0x0000000000900000-memory.dmp
memory/1544-123-0x0000000100000000-0x00000001001D4000-memory.dmp
memory/1648-137-0x000007FEFC521000-0x000007FEFC523000-memory.dmp
memory/1652-96-0x0000000010000000-0x00000000101DE000-memory.dmp
memory/1652-95-0x00000000002F0000-0x0000000000357000-memory.dmp
memory/1652-74-0x0000000010000000-0x00000000101DE000-memory.dmp
memory/1652-67-0x00000000002F0000-0x0000000000357000-memory.dmp
memory/1804-172-0x000000002E000000-0x000000002E1F4000-memory.dmp
memory/1804-173-0x0000000000230000-0x0000000000297000-memory.dmp
memory/1816-193-0x0000000000360000-0x00000000003C7000-memory.dmp
memory/1816-201-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/1816-192-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/1884-316-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/1884-318-0x00000000002D0000-0x0000000000337000-memory.dmp
memory/1984-147-0x0000000000230000-0x0000000000297000-memory.dmp
memory/1984-155-0x000000002E000000-0x000000002FE1E000-memory.dmp
memory/1984-146-0x000000002E001000-0x000000002E003000-memory.dmp
memory/1984-169-0x0000000000230000-0x0000000000297000-memory.dmp
memory/1988-72-0x0000000140000000-0x00000001401DC000-memory.dmp
memory/1992-69-0x0000000100000000-0x00000001001E3000-memory.dmp
memory/2052-205-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2052-207-0x00000000008D0000-0x0000000000937000-memory.dmp
memory/2132-216-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2132-212-0x0000000000260000-0x00000000002C7000-memory.dmp
memory/2132-211-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2260-225-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2260-223-0x00000000006B0000-0x0000000000717000-memory.dmp
memory/2344-232-0x0000000000BA0000-0x0000000000C07000-memory.dmp
memory/2344-234-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2428-243-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2428-245-0x0000000000330000-0x0000000000397000-memory.dmp
memory/2428-239-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2516-257-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2516-256-0x00000000005F0000-0x0000000000657000-memory.dmp
memory/2604-265-0x00000000005F0000-0x0000000000657000-memory.dmp
memory/2604-262-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2688-276-0x0000000000C10000-0x0000000000C77000-memory.dmp
memory/2688-263-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2688-275-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2780-281-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2780-279-0x0000000000BC0000-0x0000000000C27000-memory.dmp
memory/2868-287-0x0000000000380000-0x00000000003E7000-memory.dmp
memory/2868-290-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2952-295-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/2952-296-0x0000000000230000-0x0000000000297000-memory.dmp
memory/2952-300-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/3044-313-0x0000000000400000-0x00000000005E7000-memory.dmp
memory/3044-312-0x00000000007E0000-0x0000000000847000-memory.dmp