60e5015704adf71dae4308871805da9e84d2d22f92baf16c2e1819521a046293

General

Target
60e5015704adf71dae4308871805da9e84d2d22f92baf16c2e1819521a046293.dll
Size 6.3MB
Sample260916-jnss8agq21
SHA256 60e5015704adf71dae4308871805da9e84d2d22f92baf16c2e1819521a046293
MD5 5454aaf032ecf8e13c5240857ba49e5c
SHA1 27b23bf7be5729f3aed170597d70302c8c2dff31
SHA512 aa5cd7c1ec488f2ed70a6fdee33c33e9bee5f70d03128364ef8ff013ccd638d92aeb827534ed0a2ec11e1b7d0b8b951f9c4ca36604f0be49dbe0e11cea120930
SSDEEP 196608:Qn7N8ne2zc3lJJd/BSBz8TPVekTtWaL0UK6KfbZr:Qn7N8pYD/vvTga2T
TLSH
T14C66F112BF40F016D54B00F5751DA7E910A8BA30546598B3B79CBB0EAABC7C3E925BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3984	rundll32.exe
4	3984	rundll32.exe
13	3984	rundll32.exe
15	3984	rundll32.exe
17	3984	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gimgggabfigedfmidfhmgaaccgefdfnj\1.0_0\manifest.json	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rundll32.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rundll32.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\{9A9F9ACC-B19C-4B66-8FE8-814016970733}.xpi	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{9A9F9ACC-B19C-4B66-8FE8-814016970733}.xpi	rundll32.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe
3984	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3984	4128	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e5015704adf71dae4308871805da9e84d2d22f92baf16c2e1819521a046293.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e5015704adf71dae4308871805da9e84d2d22f92baf16c2e1819521a046293.dll,#1
  2⤵
  - Badlisted process makes network request
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{9A9F9ACC-B19C-4B66-8FE8-814016970733}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{9A9F9ACC-B19C-4B66-8FE8-814016970733}.xpi
Size 667KB
SHA256 33ea3c1697b3c7c1ca9d2e6340fe47390c18f66080fc5835b068d4e0cbfe82d7
MD5 c4cf79b3710ef41584354fa50383bb77
SHA1 e1db22c8dc6e8ea91f826843ab8948f0ff2d2615
SHA512 d38b15ef86d32b324138238ff7f59866e46cf44440f7229546f5f22b5a428bca58363bcddf0227d9359f3b066a5fa01a3e457ce03590d5d3779490c0d8a309f1
SSDEEP 3072:CaceSlDzf776sTtj/eEDp5DmB3jXBxLKimX23s6bO+B9jIvYrMdrN9EM9vRT258L:CZeSRzBCKygN9B8HWtUyRP9yq3Wryv9
TLSH
T19BE4BF6973B4030D8B89FA39107F9D2ED1DBC6E5C02654C5C4E19C8F297EE563E1ACA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gimgggabfigedfmidfhmgaaccgefdfnj\1.0_0\_locales\en\messages.json
Size 150B
SHA256 9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249
MD5 33292c7c04ba45e9630bb3d6c5cabf74
SHA1 3482eb8038f429ad76340d3b0d6eea6db74e31bd
SHA512 2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754
TLSH
T1E9C08C0F00282EDD336356C93C4961402C8A02C201C920E1D8C9C40C136FAD8011A0DB
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gimgggabfigedfmidfhmgaaccgefdfnj\1.0_0\_locales\pt_BR\messages.json
Size 161B
SHA256 5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839
MD5 5c5a1426ff0c1128c1c6b8bc20ca29ac
SHA1 0e3540b647b488225c9967ff97afc66319102ccd
SHA512 1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4
TLSH
T192C08C0A43642FC9772BC7CA380827886CCB82E602C824F3D8C5CA0E63FF6C812011A3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hbiichfklkmlebacdfhkojcpmmakmamk\1.2.0_0\_locales\es\messages.json
Size 186B
SHA256 1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152
MD5 a14d4b287e82b0c724252d7060b6d9e9
SHA1 da9d3da2df385d48f607445803f5817f635cc52d
SHA512 1c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb
TLSH
T177C0126904901E9A432697F7F546E606958543D172C1C2F2D8E9C10D271FBCB6A111B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3984-0-0x00000000026D0000-0x0000000002CB2000-memory.dmp

Download

memory/3984-9-0x0000000003120000-0x00000000031A5000-memory.dmp

Download

memory/3984-37-0x0000000003860000-0x00000000038BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads