06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90

General

Target
psychedeliclove.exe
Size 275KB
Sample260930-phkhjsxanh
SHA256 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90
MD5 ae5450f32bcb533c5b592c77a7861553
SHA1 85e01bdb2aee0217932e108535691c898b138a80
SHA512 5cd8929d374d5064ca7d47a4b468d983bdeff34354b7924a049cf8e52d366d2479fc5c0687527648b4e8227811f94ef13f6df99272b49541ccf3f514e348a13e
SSDEEP 6144:fheWYL+ZPJIYjK9GZLBpdPGq1Kq0CGpNMm:fHPZCYjK9GZdPGqd+NM
TLSH
T132545C57E25364ECC167D2388697A732B932786201747E6B3A1CC6727F21E60A73EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	psychedeliclove.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	psychedeliclove.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	psychedeliclove.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	psychedeliclove.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe
3900	psychedeliclove.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 2176	3900	psychedeliclove.exe	90
PID 3900 wrote to memory of 2176	3900	psychedeliclove.exe	90
PID 3900 wrote to memory of 1580	3900	psychedeliclove.exe	92
PID 3900 wrote to memory of 1580	3900	psychedeliclove.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\psychedeliclove.exe
"C:\Users\Admin\AppData\Local\Temp\psychedeliclove.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

128.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\4A468D0DB6792336BAD9C9AA0D036EDEC8AC40D741D5D206C08E864DEE3172D4\e0\icons\128.png
Size 6KB
SHA256 e83f6f9df6e7cb64ebb80ee0063e40e0f3beca3b965595e88ab56f56e061ed5a
MD5 f8dbd8e9ee75e1b9f0d2a19772be1a11
SHA1 cd9d65ccbdd711079655d9eb00c1b4059a6e2428
SHA512 31ea9dc129b304f0157485d2e6b2d8119b461ac6dc1978a5111241f76955a24ff5de1b4387b06e07e45cd71afa3f46e2744f5e7f4612b507058cdff1ea26acfb
SSDEEP 192:QlG05FSSG7qwTakYyea85wm2lTr0uG5MyT7/XwrDf:QljTrG1TBYyeavIB5rTz0D
TLSH
T1E1E1BF8C53EC98BBF1C50D9E42680D369FEBF256129C900ED853D04C4B104F20CBE796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\4A468D0DB6792336BAD9C9AA0D036EDEC8AC40D741D5D206C08E864DEE3172D4\e0\manifest.json
Size 2KB
SHA256 c10b5833016bc7d444395c11bb1729268858ab594d3f79f2e30002aaf6c0879d
MD5 2730856ddee4b2fb494b9e397931eb1e
SHA1 417cbe076d3ef31c6257d35c250c89c20b655b04
SHA512 8bd095109168dcf60c2797c7dc6de1a455a4e47a9380499a840880f39eb87bc304287c15244be38f7c29378f61673678ec43f549ddf554f8f96e4ae4f73b98e5
TLSH
T1C141DD25D9684CBB02DCA7346CBA5A8369140A878D907C1C77DD800C8F7D21F42B6B9D
MD5 SHA1 SHA512 TLSH

Submit Download

ck_3900_240727359.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_3900_240727359.bin
Size 32B
SHA256 d5b75dd798d634aae83333ab3f75bcef62d1b486ea288876de5a828739deedc7
MD5 e9a34e3934cb1c5fd25f4bc03119e05f
SHA1 a652335424f4a7e1b5b32c8ecd51b0187095e89d
SHA512 e2738a379710e78c659134a4592d1c96e9b6dbfd9ba5be6d89ef8a60bc7929bcd0d993928a27b5ecf518ad7898402a93c3136f48d0d4dee9e1cdb0341a9c606d
MD5 SHA1 SHA512

Submit Download

ext2486.tmp.zip

Path C:\Users\Admin\AppData\Local\Temp\ext2486.tmp.zip
Size 45KB
SHA256 bdefc03a38d9bf51a5d5388a0ac517b6428cb448a80b6a89cb517d31e9e4704b
MD5 e6fd959586df9bd9d3b933b91bff1df3
SHA1 727b3913469bfc911f564d3bd5e9b92a1961db23
SHA512 1ca269879f85e6ef3e722840f28eb3e9f0a81608d1a6b754eee0e503ce66a8f90131bdf6925635b2f970e39dc80eba42742e7f11fdb4e60b568c11cfc5a87e6f
SSDEEP 768:HNuUnGsTvPRVvkzIv6Bv2x1NTwePepQITBYoIB5rTXITBYoIB5rT5zhj/2:tuaG0zWICBOxPTtBH1rbH1rNzh/2
TLSH
T12523F1595790483FD7DB597C40268E34CE9F79B0028D509FC967F48C9A068A32BE6BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3900-267-0x00007FF62C3F0000-0x00007FF62C43D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads