a0b8c8b57cebef1a3249e4c7878b786a59d692e9b07657c7988104607015b6b7

General

Target

8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe
Size

720KB
MD5

fbdd33cf51fe4113000a7fc14908b56d
SHA1

ceaf739f285eabea68567e2df0288406b3e99138
SHA256

8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b
SHA512

f51d77cd871e69db2c082cff560fed3049b70797f862f56651cf165a34329f26257050b80417770cd6e070f2559ef976e35d324380a4f8ab1da42eca538d310b
SSDEEP

12288:aAkzqQTJ0C2Yk46NAF75VeLXoM52eVDOvvXx1I5y1wWEQnEC:aAcJ0C2Yk46NsV9M5TV0v2y1R1

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\debug.log	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1260 chrome.exe
1260 chrome.exe
568 chrome.exe
568 chrome.exe

pid	process
1260	chrome.exe
1260	chrome.exe
568	chrome.exe
568	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exechrome.exe

description	pid	process	target process
PID 4588 wrote to memory of 568	4588	8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe	chrome.exe
PID 4588 wrote to memory of 568	4588	8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe	chrome.exe
PID 568 wrote to memory of 4876	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4876	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 4192	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1260	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1260	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe
PID 568 wrote to memory of 1116	568	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe
"C:\Users\Admin\AppData\Local\Temp\8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  C:/Program Files/Google/Chrome/Application/chrome.exe -autoplay-policy=no-user-gesture-required -disable-notifications -mute-audio -headless -remote-debugging-port=9222 -user-data-dir="C:/Users/Admin/AppData/Local/Google/Chrome/User Data" http://79.137.206.202
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c214f50,0x7ffc9c214f60,0x7ffc9c214f70
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1404,8255575486935130909,2648849963130665406,131072 --headless --headless --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1424 /prefetch:2
    3⤵
    PID:4192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1404,8255575486935130909,2648849963130665406,131072 --lang=en-US --service-sandbox-type=network --use-gl=swiftshader-webgl --mute-audio --headless --mojo-platform-channel-handle=1640 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --autoplay-policy=no-user-gesture-required --disable-notifications --remote-debugging-port=9222 --allow-pre-commit-input --field-trial-handle=1404,8255575486935130909,2648849963130665406,131072 --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=1848 /prefetch:1
    3⤵
    - Drops file in Program Files directory
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --autoplay-policy=no-user-gesture-required --disable-notifications --remote-debugging-port=9222 --allow-pre-commit-input --field-trial-handle=1404,8255575486935130909,2648849963130665406,131072 --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2052 /prefetch:1
    3⤵
    - Drops file in Program Files directory
    PID:4816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --autoplay-policy=no-user-gesture-required --disable-notifications --remote-debugging-port=9222 --allow-pre-commit-input --field-trial-handle=1404,8255575486935130909,2648849963130665406,131072 --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1460 /prefetch:1
    3⤵
    PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\??\pipe\crashpad_568_FTZIQCRFUHLTYIOU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Resubmissions

Analysis

Sharing