Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2024 16:51

General

  • Target

    d37ebec14107db79949dca420554b4c5c98d723a831cb6b421477957e01366ccN.exe

  • Size

    717KB

  • MD5

    01f2ddbd526a235a6dc60161dfeb3500

  • SHA1

    f427f7615263ed3ea72e5758cbecf9c87b345e13

  • SHA256

    d37ebec14107db79949dca420554b4c5c98d723a831cb6b421477957e01366cc

  • SHA512

    22791f62ed641cd8cd9a2b6c80a19c492d29eff5e6c09bb08f986bd3e7e63baf48cf420d4f0c3a18af8accf568a1a04db8eb60f7b8c184bacf75c51ee325b7ad

  • SSDEEP

    12288:UKnekrL58os15KGL6W6GEx0NRKOPBK7dzOZdEYCwLs6gVqJkB8+4a+nQJ6:9Lio0bl2PmQ1hqLgMaJ6

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d37ebec14107db79949dca420554b4c5c98d723a831cb6b421477957e01366ccN.exe
    "C:\Users\Admin\AppData\Local\Temp\d37ebec14107db79949dca420554b4c5c98d723a831cb6b421477957e01366ccN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\00294823\fN.exe
      "C:\Users\Admin\AppData\Local\Temp/00294823/fN.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\00294823\euo3@lccfhy.org\bootstrap.js

    Filesize

    2KB

    MD5

    1b53c596cfb1aa2209446ff64c17dabd

    SHA1

    2542da14728dcdbe1763f1ee39fe9ceae38ad414

    SHA256

    a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

    SHA512

    be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

  • C:\Users\Admin\AppData\Local\Temp\00294823\euo3@lccfhy.org\chrome.manifest

    Filesize

    96B

    MD5

    b696af0e32be16ce44c176a1ef16d5d1

    SHA1

    5d159e0147fc467c6cd6d6bd0f899510a9e019da

    SHA256

    53e2856170795e6ed855a17b6e7f65dc558f9b8f3333c5fbcf4b1e6d24ee1d6d

    SHA512

    6c0937ec2163d5175e6906d903dcbb56b114fba07aef64863a1fedb7e75d779dc37f78e3009e176a9abef8e3e274ea72430c5e10a5e237fe2f3fac2111e17e17

  • C:\Users\Admin\AppData\Local\Temp\00294823\euo3@lccfhy.org\content\bg.js

    Filesize

    9KB

    MD5

    fcb8803f44ab49c2a040f9b0aa2632f8

    SHA1

    e193904bf3185d9199ebd067aa7d0d0b6d50f3ea

    SHA256

    45cc82f11ae0f0af570b5f039b56163ed05aaf682f0159022748d8de8620c277

    SHA512

    5338e89e48a774b2e3f65b898a01fa4e6c7301f5c71e351f21f6e4f1f1811030056af3ab1db018ad6b81f6c53214661b71a293dd364bd306bc46471ceaa589d0

  • C:\Users\Admin\AppData\Local\Temp\00294823\euo3@lccfhy.org\install.rdf

    Filesize

    605B

    MD5

    4742ec2ba00a42c7aa220338097470a5

    SHA1

    b08cf2c5d2dbd5887729d6ae6044bee411ae3843

    SHA256

    d2a56bcd0a9577f2c0a7db2dab635660010df3fb6d50596c2ff1c3471da35e9e

    SHA512

    aed05558a39806b1305683d0d75100d1c99582378ecceaaec0d45f1166c1ddc8ddfacfad4fd139265b5c1230d05fca86f97bbe1c9d794be6d61b4a1d4e9635fe

  • C:\Users\Admin\AppData\Local\Temp\00294823\fN.dat

    Filesize

    5KB

    MD5

    5fa7cea7c12105c7f54c5739f398fbff

    SHA1

    6ca2b4416b5c00a86c73a5d911d0c232c3f2d548

    SHA256

    ae09ff7d46923533a589a7a1654a16be1b47e7331924e1e3680442117789d0f9

    SHA512

    90a0d2e13f36c2b9b73dc69fbd12c9f5314061b9778f65336581104481b961ce78773807ae300e78910fa1e804df4f2867f645561cc42b9add53a62d2c5e9817

  • C:\Users\Admin\AppData\Local\Temp\00294823\fN.exe

    Filesize

    334KB

    MD5

    8300c91b40229b42301aebc6d8859907

    SHA1

    0b55e56a6add6b4dd4ceff475a0018a203d02a5a

    SHA256

    f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

    SHA512

    0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

  • C:\Users\Admin\AppData\Local\Temp\00294823\n.dll

    Filesize

    222KB

    MD5

    e9b27306a18f18b88945cdf066de2fc9

    SHA1

    4d18490fbb336e261301a967047065dd561cc2f2

    SHA256

    a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c

    SHA512

    f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706

  • C:\Users\Admin\AppData\Local\Temp\00294823\n.tlb

    Filesize

    2KB

    MD5

    39d776f73d1d3f771aaa8c3561367c3a

    SHA1

    eef842aa02927bd7fbe7d569c5446ef1a2ea065f

    SHA256

    c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941

    SHA512

    3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3

  • C:\Users\Admin\AppData\Local\Temp\00294823\pfhckkdmdemacnlihjopeaikikigjnlo\A0.js

    Filesize

    5KB

    MD5

    a6954de18e3644625b515283e92ab296

    SHA1

    d1b0803c471f821c5056c33af0e5dbf749c401dd

    SHA256

    c9112c1ee7e129b7fdd3602b6a76760390dba41fd4ef97608a4fd27f4aa2d734

    SHA512

    f146e1a76618a3349d7c2d998efaba190bea07c1a4faaea863bc9d1bf8636231682b60305c84644c7481e5c0424f604eb5bcf39265f160a489432fbbd6c11c6e

  • C:\Users\Admin\AppData\Local\Temp\00294823\pfhckkdmdemacnlihjopeaikikigjnlo\background.html

    Filesize

    139B

    MD5

    5dae2433296d93d349c0bc05d5804714

    SHA1

    2b319c23c9476a7a0a94470fcf097f2b1ba84d13

    SHA256

    89d58831ec6d79363d34ebf72913ab0a28bc91618eb70a99113e4c4394a54032

    SHA512

    cef7055270f9e75c92f64d28ef27b1a8dfda67fb89f01ac00e77b1fde304d4ce91d456e42c908b246c012f55a23ad4ed95d0048db1604a07cbad6c040babe055

  • C:\Users\Admin\AppData\Local\Temp\00294823\pfhckkdmdemacnlihjopeaikikigjnlo\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\00294823\pfhckkdmdemacnlihjopeaikikigjnlo\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\00294823\pfhckkdmdemacnlihjopeaikikigjnlo\manifest.json

    Filesize

    508B

    MD5

    74cf0a20b75270d9c6e793475850e700

    SHA1

    f15bc921556a6eb098ba72796a8ee6a8ee1e9de4

    SHA256

    9221dce2e9533b1471273de4f51274c52e54eb7597cf9615046e7c11b3453331

    SHA512

    0f4225831d6dae88bb1b24506073ce32e2c91d2d8601c40cf328ccf31d7f88d8e012d78d0679f5f6c279a10b20da2e093a9b500428ee9525a2d383fa0c171839

  • C:\Users\Admin\AppData\Local\Temp\00294823\pfhckkdmdemacnlihjopeaikikigjnlo\sqlite.js

    Filesize

    1KB

    MD5

    f9182efd36cd7915064fa4fb55c42e62

    SHA1

    38ad299e900939d40e5beb88fe74ddbd23ef5906

    SHA256

    8eb1066ac3abec55ee0c6d5eeff50992cec9eba0e28788074a118ff79ed15f7d

    SHA512

    072140d1be9bf0d6c32be082f6f4cefcaa14041417b8f9783dc2ec7098010c2dbf5f2e44960ea6301a4fa93b8962bbbec2dd6b710abeb1346ae3826d270f8d24

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.