dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe
Size 1.2MB
Sample241108-nrd7fstpgn
SHA256 dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949
MD5 a0149f2440788d682896b4e6139b64a0
SHA1 3cd573cb130fb0ab6a13e83f738979a1c1f66d23
SHA512 15740cd6001a3cb406b10497d8540c76ac2e3f273160b97fc1fd9a4e39e157f617614152207b9d59a0586ad3e24d53f26e97c7937131f3b38e570b041f8232d5
SSDEEP 24576:9GqZoVgqhRGD4chfjzt/Xzan7HS/El7s875W:1Z9URGD1jJz47yi7s875W
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4920	m31yxabXomY.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\njpobjgbbbkmlphcmbmflagolbckfhfb\5.14\manifest.json	m31yxabXomY.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\njpobjgbbbkmlphcmbmflagolbckfhfb\5.14\manifest.json	m31yxabXomY.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\njpobjgbbbkmlphcmbmflagolbckfhfb\5.14\manifest.json	m31yxabXomY.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\njpobjgbbbkmlphcmbmflagolbckfhfb\5.14\manifest.json	m31yxabXomY.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\njpobjgbbbkmlphcmbmflagolbckfhfb\5.14\manifest.json	m31yxabXomY.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m31yxabXomY.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4920	940	dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe	83
PID 940 wrote to memory of 4920	940	dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe	83
PID 940 wrote to memory of 4920	940	dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe	83

C:\Users\Admin\AppData\Local\Temp\dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe
"C:\Users\Admin\AppData\Local\Temp\dbaf809b7b3326095a7f4101916619edd949e8ae8664c3160fa3a6c043e38949N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\656a2eac\m31yxabXomY.exe
  "C:\Users\Admin\AppData\Local\Temp/656a2eac/m31yxabXomY.exe"
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m31yxabXomY.dat

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\m31yxabXomY.dat
Size 1KB
SHA256 c43125edc0797abdd729d70c2c88efd46fcb9b08f7a8c94f5638ace05363f821
MD5 2e40058e5d7e8844b28213bd7badbc73
SHA1 649fd2f6bc8c18c80d8432d244452c1140bfabc1
SHA512 fc2abc3374414bd08fdcfae1b5797748837070fad6d4eeed98130839f1c0c627aee7781c65c21a3018d5bd4964606ac4d2c939ae42b552fd7cb9734d69e5b3ee
MD5 SHA1 SHA512

Submit Download

m31yxabXomY.exe

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\m31yxabXomY.exe
Size 673KB
SHA256 c7caf170cd3921be3df975808694f7b1c014b7ce4a9b1fa6a5c535dd13d87c7f
MD5 eb4ce60ecd7f5821196fa0e2996ea50b
SHA1 e064ed415866ae5d0858da32b7a9d73614f50c92
SHA512 bd86fb40c5b16bd98f89718ebe7c34bf76e26c9b2d46b9be6d3ad61d1023b0c8510fc3b1e037b3fb346afb916506b965931a358424cc61b6afe1d3206dd80373
SSDEEP 12288:JeZrK0op0la6nFiUZFTDO2EYMYhtVxp6lnvizSg1Xl2Tulck7K4qWqfiU:JeZrK0op0FFiUZ5aZsVxponvuH2q+k7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\njpobjgbbbkmlphcmbmflagolbckfhfb\background.html
Size 149B
SHA256 950c4c528c0ab421d47904c1e0af660138a2050f6082a66c5d93cc4fd9b3ef01
MD5 68a17579b5903e2c6a1cb3460435e367
SHA1 7b88b9abe4d862cbd23d4ddf9125c76c713eb433
SHA512 908d8af687755a3dddf340bfe6647011a24a35abd473fc6a5e62d493be74866d5405d597ad3ff5b5f1c788fc435faa96f9c4949e04e5c82621b25e9dff2613a6
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\njpobjgbbbkmlphcmbmflagolbckfhfb\content.js
Size 5KB
SHA256 1cba1eb54c74090186c845e8cdaab31c89b13c9255f34c769be37976304dea7f
MD5 85c0f60418694812a2edb163ab158ca4
SHA1 6ca2916a57b56f7180daa5a78f06b2f090d313e4
SHA512 29d9a39fa6934a2b6779d42321123820947d53e45b0ba5a56d820e0994d93d9741d53980c512c8ee0649c19069371bcb6ea937b2096b68f195fd8993eaa2a8d7
SSDEEP 96:tVT8w01RGTQ4qOz+l/fENIR3WV+yxEjmf4+72RIf9EuwZU9m8zC1A7CJOV578XR8:DL0jmxz+lX3G8yx2472RI1deqf78Xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

j2I2aMf6q4AO.js

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\njpobjgbbbkmlphcmbmflagolbckfhfb\j2I2aMf6q4AO.js
Size 24KB
SHA256 29f1c9edb821a72c56c3755dbbed1445295cef4750a4a0103bb7ab8e1d46c6ec
MD5 1a35454546dca40f14c806fc9d6711fd
SHA1 6137b10cb42b996052c9769797a2d81c645db5ee
SHA512 789471d248805aa02864175d4d4571923460bd9287e56cd8143278dca670593f33eeb840adf35fd0beb226c78b1a2cd153234351afea45178424890d1845f21b
SSDEEP 768:OcaSYsBLRSYgsytre3wRFT8kRIYNj1oO85:O2RgsgreGFT8kzp1oO85
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\njpobjgbbbkmlphcmbmflagolbckfhfb\lsdb.js
Size 8KB
SHA256 790093f3586462a2d7650e3c7625c8f1700946ac20ee4e7799fd062b48a09edd
MD5 7767fbd070aeda76f9214c63e8857543
SHA1 9fe9ec99dfd95ed2aa2c04dd5e7d6b2759d97cb4
SHA512 e5fa726b8b39bf42789d374c93132684b864b7603b2c51155a5b01de8352da7aae254937e368ba8e3bc1f78007c2ebae4525926b8d1a3fc4e6d6f729a1cb4ade
SSDEEP 192:MpHMM63C6XhRXdplGwuh61if2mvGwgHDOYjDauBzlnvmg6Wbo:MpHMM6XdXGDhGif2m+LHDOW2uhYg63
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\njpobjgbbbkmlphcmbmflagolbckfhfb\manifest.json
Size 503B
SHA256 e2ad313c4bc6be746294cd782bc5a6fc6bfa72b22fa8a03fa0fb20fc996a3103
MD5 4b991408dbed4bfce0b5c7efc0bad4c2
SHA1 05b40b5b419350b5f8bdeaef07b990850dc8245c
SHA512 57a1b6d3b3e51acffd3dbc59b25d3e00c747b43171a582683dae92c5528c625fd9652c653cd983bc9f55ddb8b53c5b46c83c9caba7babb4354795efe7ef48256
MD5 SHA1 SHA512

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\[email protected]\chrome.manifest
Size 31B
SHA256 9e362fc6f237ea793bc113c624d898bc13f926ed84a8643387ed73c9d2e613e9
MD5 139172969acdc5048585b9e724235898
SHA1 1bc19fd03e7257f53de3c2776ee074f84e557f4d
SHA512 8d6223f8aebe68d38b301a4d9fc9b562b13bdc1c7712643d1618313ea89f250e24580a632712b1d99af6ccb0b32c07f3333123589f8ee00de389cccf208732b9
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\[email protected]\content\bg.js
Size 29KB
SHA256 7740de7a5f36ad48f2eff3733b1f55fceef6d09ec71cffd55d9b2762fc1ef404
MD5 6b32c26322d0ec63b3c9f113a9cd14c9
SHA1 ec7d0ce9589d7ab8f4a2bfc7c480fb172f82dcf9
SHA512 2ec1e4b0edc9e452d1592a01979878ba521cc6a8ef0b1291132f3ba8ee1071846fefeef2f7d4c1c20648cb87a972cd3890fbab5c528eef76a9f5584450a90199
SSDEEP 384:YtTflo9/HhbsgQXvKPbVgaKV6jpx9A9puvnqIldGQf9MIRlGr3L2UYTsM5scc:qRo9PhZIKPJewjpx9XnaTIrmPYTsM5Lc
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\656a2eac\[email protected]\install.rdf
Size 605B
SHA256 38d6fb9387500ed7f61d91b4a9740324b0636dc44616bdb2a8b1ba09b1463e97
MD5 9b877d0ea49fcbafe40e6426c2bc8661
SHA1 684bf3673054b9aefb9803032cec412c62d83f8e
SHA512 6b19092bb7242e79aecef7961f1f6c987ddd6e43bf2673cdaf8833795f8ac45a23354ba79db59a65f6f96f564c5c3aa21180a2fe3ced07868d1272076d3de835
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads