d31af3da89cca5e2b2c0fc5e86edc9b27782f4b10678ad94f946c34a94acaa18

General

Target
9b0892598b3725a436c414e9dddb9ef43b85d9bb08c2007dd8735a14374d132e.dll
Size 6.4MB
Sample240902-bcv57sxapn
SHA256 9b0892598b3725a436c414e9dddb9ef43b85d9bb08c2007dd8735a14374d132e
MD5 06ea49951dde098f018a213ee7a8a38d
SHA1 e8e31ed1db5f018664abf85154112ee1f478e9e2
SHA512 85f2e17fb372f82c819e0abc631e4d6fefc12cb31995abb5410d7c99a288b257b01e37657f0b60bf9e02e32c4653f2c252e91e042b9b6069679231274f5543f5
SSDEEP 98304:Fw5fRmhQ1orSk3GCK4J7vADNR6oXc0/8+x0bRtI4PPgbYhiLC9kEN6+/mu:ifiQ15M2aIDS0i+SRi4samC9bN9O
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
13	3212	rundll32.exe
15	3212	rundll32.exe
17	3212	rundll32.exe
22	3212	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlhgjfmdjomnlhfacokoibjlcmcmgoec\1.0.0_0\manifest.json	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rundll32.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rundll32.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	rundll32.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{EA8CA8DA-5FF9-493B-AC9C-93682EE7EB16}.xpi	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{EA8CA8DA-5FF9-493B-AC9C-93682EE7EB16}.xpi	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3212	4972	rundll32.exe	83
PID 4972 wrote to memory of 3212	4972	rundll32.exe	83
PID 4972 wrote to memory of 3212	4972	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b0892598b3725a436c414e9dddb9ef43b85d9bb08c2007dd8735a14374d132e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b0892598b3725a436c414e9dddb9ef43b85d9bb08c2007dd8735a14374d132e.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{EA8CA8DA-5FF9-493B-AC9C-93682EE7EB16}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{EA8CA8DA-5FF9-493B-AC9C-93682EE7EB16}.xpi
Size 641KB
SHA256 3d1557ad4d39d30988e36978be948cd1bb11910c156658b0c5a01e4820e6566a
MD5 4dc40f90e7ff46e8270dc8c026e7a246
SHA1 6b937a306eef12ac460ef650d2ccf51f19381282
SHA512 4f24a9e937e63b4759ffcb860c7aba9f55e524b51346c1a42f3277b20ea7cf4449005d97f681e89ab572aec277d8895c64b32a24aa0d76f55a18b1eb9d2b128f
SSDEEP 6144:AZesRrvWTxOdD/xwa4+5DB4g3WdEahAGNdYpw516e:ALIqdElHCe
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlhgjfmdjomnlhfacokoibjlcmcmgoec\1.0.0_0\_locales\en\messages.json
Size 150B
SHA256 9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249
MD5 33292c7c04ba45e9630bb3d6c5cabf74
SHA1 3482eb8038f429ad76340d3b0d6eea6db74e31bd
SHA512 2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlhgjfmdjomnlhfacokoibjlcmcmgoec\1.0.0_0\_locales\pt_BR\messages.json
Size 161B
SHA256 5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839
MD5 5c5a1426ff0c1128c1c6b8bc20ca29ac
SHA1 0e3540b647b488225c9967ff97afc66319102ccd
SHA512 1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\fileepgfmlpabmkbocijoaggdmlhenbf\2.2.0_0\_locales\es\messages.json
Size 186B
SHA256 1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152
MD5 a14d4b287e82b0c724252d7060b6d9e9
SHA1 da9d3da2df385d48f607445803f5817f635cc52d
SHA512 1c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb
MD5 SHA1 SHA512

Submit Download

memory/3212-1-0x0000000002790000-0x0000000002D6A000-memory.dmp

Download

memory/3212-11-0x0000000002640000-0x00000000026C5000-memory.dmp

Download

memory/3212-48-0x0000000003290000-0x00000000032F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads