Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
4a579b82b404dda9baa4565e6701ee87.exe
Resource
win7-20231215-en
General
-
Target
4a579b82b404dda9baa4565e6701ee87.exe
-
Size
717KB
-
MD5
4a579b82b404dda9baa4565e6701ee87
-
SHA1
a2d068bd0875baed84153777a0052ddba54bfc17
-
SHA256
108e077a393f52d496ae83dd05472ff3ccb3d469478309b1d49c70c93e1cf667
-
SHA512
45e526cb052c7529a8ea8354f841c29383d9971d86c12ae13227a7643a7f5405babc67ae9e3351be7d9179bbc0bfc11f24101804a9494f3db0b97ca688189102
-
SSDEEP
12288:BKnekrL58xwokOTtwN6jBFyy26caMHC2N8+NALWKrYPTDN89Q4SvrM4ykAznsZHC:OLix4SnFDFcHFNASXbp89QHzM4ZAzuHC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4388 T4Xo4.exe -
Loads dropped DLL 1 IoCs
pid Process 4388 T4Xo4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\haaopachmoimjkjefpbpadndimigbdgj\1.6\manifest.json T4Xo4.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ = "DowwnlloaD keepEr" T4Xo4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\NoExplorer = "1" T4Xo4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} T4Xo4.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration T4Xo4.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} T4Xo4.exe Key deleted \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} T4Xo4.exe Key deleted \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration T4Xo4.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6\CLSID T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CLSID T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32\ThreadingModel = "Apartment" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CurVer\ = "Downlooadd keeper.1.6" T4Xo4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ProgID T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CurVer T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\Programmable T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib T4Xo4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\VersionIndependentProgID T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DowwnlloaD keepEr" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\VersionIndependentProgID T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6\CLSID\ = "{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Downlooadd T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6\ = "DowwnlloaD keepEr" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeper\ = "DowwnlloaD keepEr" T4Xo4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeper.Downlooadd T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeper.1.6 T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeper T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeper\CLSID\ = "{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ProgID T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ProgID\ = "Downlooadd keeper.1.6" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32 T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} T4Xo4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32 T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DowwnlloaD keepEr\\JuaU.tlb" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\ = "DowwnlloaD keepEr" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\VersionIndependentProgID\ = "Downlooadd keeper" T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\InprocServer32\ = "C:\\ProgramData\\DowwnlloaD keepEr\\JuaU.dll" T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 T4Xo4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" T4Xo4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61}\Programmable T4Xo4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" T4Xo4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4656 wrote to memory of 4388 4656 4a579b82b404dda9baa4565e6701ee87.exe 17 PID 4656 wrote to memory of 4388 4656 4a579b82b404dda9baa4565e6701ee87.exe 17 PID 4656 wrote to memory of 4388 4656 4a579b82b404dda9baa4565e6701ee87.exe 17 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{C6EFEA96-BEC4-1E4D-6AC4-6330FEADDC61} = "1" T4Xo4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a579b82b404dda9baa4565e6701ee87.exe"C:\Users\Admin\AppData\Local\Temp\4a579b82b404dda9baa4565e6701ee87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\00294823\T4Xo4.exe"C:\Users\Admin\AppData\Local\Temp/00294823/T4Xo4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
PID:4388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
334KB
MD58300c91b40229b42301aebc6d8859907
SHA10b55e56a6add6b4dd4ceff475a0018a203d02a5a
SHA256f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
SHA5120863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f
-
Filesize
92KB
MD5ac22720c569c5178894c02e3d28582a3
SHA1a946bac539edfea7b6af287e58d8bf111f6d8ce5
SHA25643e80bd841ee840d321fc00aaf05d8b1274d2860aee407d956e3df7ff33a105c
SHA5125f4dca640ee485e5a5ca14222cc46480c1a875a84869996f24d4edad86ff4ade53f53b5399c076680e3b5fc3ef382982750c4b50f0018847c03a5c915853b821