Edit tour
Windows
Analysis Report
hJ1bl8p7dJ.exe
Overview
General Information
| Sample name: | hJ1bl8p7dJ.exerenamed because original name is a hash value |
| Original sample name: | ddefa728f5ff2f70fd097609edc4e918afd5fa212115ba2b06f818c1263df23f.exe |
| Analysis ID: | 1590664 |
| MD5: | 73d8502f47e5c7b9b4851ee47692105c |
| SHA1: | 98efc25148a119cbe7d9b421d4eff9d784c70dcb |
| SHA256: | ddefa728f5ff2f70fd097609edc4e918afd5fa212115ba2b06f818c1263df23f |
| Tags: | bot7711615259exeuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Attempt to bypass Chrome Application-Bound Encryption
Yara detected Telegram Recon
AI detected suspicious sample
Drops password protected ZIP file
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Tries to harvest and steal browser information (history, passwords, etc)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Browser Execution In Headless Mode
Sigma detected: Browser Started with Remote Debugging
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Classification
- System is w10x64
hJ1bl8p7dJ.exe (PID: 7760 cmdline: "C:\Users\ user\Deskt op\hJ1bl8p 7dJ.exe" MD5: 73D8502F47E5C7B9B4851EE47692105C) 
conhost.exe (PID: 7804 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msedge.exe (PID: 7872 cmdline: "C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --remot e-debuggin g-port=972 3 --user-d ata-dir="C :\Users\us er\AppData \Local\Mic rosoft\Edg e\User Dat a" --profi le-directo ry="Defaul t" --disab le-popup-b locking -- disable-ex tensions - -disable-g pu --disab le-softwar e-rasteriz er --disab le-dev-shm -usage --n o-sandbox --disable- logging -- disable-we b-security --allow-r unning-ins ecure-cont ent --igno re-certifi cate-error s --disabl e-features =IsolateOr igins,site -per-proce ss --disab le-blink-f eatures=Au tomationCo ntrolled - -disable-b ackground- networking --disable -default-a pps --disa ble-hang-m onitor --d isable-syn c --disabl e-client-s ide-phishi ng-detecti on --disab le-backgro und-timer- throttling --disable -renderer- background ing --disa ble-backgr ounding-oc cluded-win dows --dis able-ipc-f looding-pr otection - -mute-audi o --window -size=1280 ,720 --win dow-positi on=-3000,- 3000 --hea dless MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 8068 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --n o-sandbox --ignore-c ertificate -errors -- use-angle= swiftshade r-webgl -- use-gl=ang le --mute- audio --ig nore-certi ficate-err ors --head less --dis able-loggi ng --mojo- platform-c hannel-han dle=1600 - -field-tri al-handle= 1472,i,880 8784561077 415658,353 8669664059 517056,262 144 --disa ble-featur es=Isolate Origins,Pa intHolding ,site-per- process /p refetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F) 
WINWORD.EXE (PID: 7408 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\WINWO RD.EXE" /n "C:\Users \user\Docu ments\Your _Benefits_ and_Role.d ocx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678) - msedge.exe (PID: 2880 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --remot e-debuggin g-port=923 0 --user-d ata-dir="C :\Users\us er\AppData \Local\Mic rosoft\Edg e\User Dat a" --profi le-directo ry="Defaul t" --disab le-popup-b locking -- disable-ex tensions - -disable-g pu --disab le-softwar e-rasteriz er --disab le-dev-shm -usage --n o-sandbox --disable- logging -- disable-we b-security --allow-r unning-ins ecure-cont ent --igno re-certifi cate-error s --disabl e-features =IsolateOr igins,site -per-proce ss --disab le-blink-f eatures=Au tomationCo ntrolled - -disable-b ackground- networking --disable -default-a pps --disa ble-hang-m onitor --d isable-syn c --disabl e-client-s ide-phishi ng-detecti on --disab le-backgro und-timer- throttling --disable -renderer- background ing --disa ble-backgr ounding-oc cluded-win dows --dis able-ipc-f looding-pr otection - -mute-audi o --window -size=1280 ,720 --win dow-positi on=-3000,- 3000 --hea dless MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 1884 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --n o-sandbox --ignore-c ertificate -errors -- use-angle= swiftshade r-webgl -- use-gl=ang le --mute- audio --ig nore-certi ficate-err ors --head less --dis able-loggi ng --mojo- platform-c hannel-han dle=1604 - -field-tri al-handle= 1412,i,170 1506757892 9256214,24 3464439681 6959813,26 2144 --dis able-featu res=Isolat eOrigins,P aintHoldin g,site-per -process / prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_TelegramRecon | Yara detected Telegram Recon | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security |
System Summary |   |
|---|
| Source: | Author: Nasreddine Bencherchali (Nextron Systems): | ||