Windows Analysis Report
BSN100357-HHGBM100002525.exe

## Malware Analysis Summary

The sample BSN100357-HHGBM100002525.exe is a .NET-based information stealer identified as ResolverRAT that employs process injection and browser manipulation techniques for credential harvesting.

### Initial Access
The malware executes as BSN100357-HHGBM100002525.exe (PID 6716) from the user's Desktop directory, initiating the infection chain.

### Evasion Techniques
The malware implements multiple anti-analysis measures:
- Sandbox detection by checking for SBIEDLL.DLL and other dynamic analysis indicators
- Anti-VM techniques to evade virtualized analysis environments
- Uses the legitimate InstallUtil.exe process as a host for malicious activities to appear benign

### Payload Execution and Staging
BSN100357-HHGBM100002525.exe spawns InstallUtil.exe (PID 7460) and injects malicious PE files into it. The injected InstallUtil.exe process then performs thread injection into multiple Chrome browser processes, creating a complex execution chain that obscures the malware's activities. The malware contains large array initializations and unpacker functionality, suggesting it dynamically loads additional components at runtime.

### Data Theft
The injected InstallUtil.exe process conducts extensive credential harvesting:
- Browser data theft targeting Chrome cookies, login credentials, and web data
- Bitcoin wallet information extraction from registry keys
- Putty/WinSCP session and password harvesting
- Microsoft Outlook mail credential theft through registry access

### Network Activity
InstallUtil.exe establishes TCP communication with the command and control server at 91.92.120.101:65535, indicating active data exfiltration or remote control capabilities.

### Process Relationships
The execution flow follows: BSN100357-HHGBM100002525.exe  InstallUtil.exe (injected)  Chrome processes (thread injection). The malware launches Chrome with specific parameters including a custom user data directory and disabled security features to facilitate data extraction.

### MITRE ATT&CK TTPs
- T1055 - Process Injection (PE injection into InstallUtil.exe and thread injection into Chrome)
- T1055.002 - Portable Executable Injection
- T1555.003 - Credentials from Web Browsers
- T1539 - Steal Web Session Cookies
- T1012 - Query Registry (credential harvesting)
- T1071.001 - Application Layer Protocol: Web Protocols (C2 communication)
- T1497 - Virtualization/Sandbox Evasion