Analysis
-
max time kernel
142s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-10-2021 14:07
Static task
static1
Behavioral task
behavioral1
Sample
S00136402127536662.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
S00136402127536662.exe
Resource
win10-en-20210920
General
-
Target
S00136402127536662.exe
-
Size
588KB
-
MD5
1aad026baeaab0069ec257c151924481
-
SHA1
e5f45813bb9baba4050bd3648851336470413f74
-
SHA256
072285efab7216ad4a718dfc4208984dd2726c5357e71e5a9aac8ae7470b21d5
-
SHA512
44636d5d298c5fab28a4fce3b765bb81809f8894fbec07a81890b5357361089a6fdbe164fa3c48db5b73390b8877e20c08568adf7958ba6bad0cb6d9e13b2198
Malware Config
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
suricata: ET MALWARE a310Logger Stealer Exfil (SMTP)
suricata: ET MALWARE a310Logger Stealer Exfil (SMTP)
-
A310logger Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger -
Executes dropped EXE 1 IoCs
Processes:
Fox.exepid process 4060 Fox.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
S00136402127536662.exedescription pid process target process PID 2044 set thread context of 2644 2044 S00136402127536662.exe S00136402127536662.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
S00136402127536662.exepid process 2044 S00136402127536662.exe 2044 S00136402127536662.exe 2044 S00136402127536662.exe 2044 S00136402127536662.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
S00136402127536662.exedescription pid process Token: SeDebugPrivilege 2044 S00136402127536662.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
S00136402127536662.exepid process 2644 S00136402127536662.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
S00136402127536662.exeS00136402127536662.exeWinMail.exedescription pid process target process PID 2044 wrote to memory of 1768 2044 S00136402127536662.exe schtasks.exe PID 2044 wrote to memory of 1768 2044 S00136402127536662.exe schtasks.exe PID 2044 wrote to memory of 1768 2044 S00136402127536662.exe schtasks.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2044 wrote to memory of 2644 2044 S00136402127536662.exe S00136402127536662.exe PID 2644 wrote to memory of 4060 2644 S00136402127536662.exe Fox.exe PID 2644 wrote to memory of 4060 2644 S00136402127536662.exe Fox.exe PID 2644 wrote to memory of 1544 2644 S00136402127536662.exe WinMail.exe PID 2644 wrote to memory of 1544 2644 S00136402127536662.exe WinMail.exe PID 2644 wrote to memory of 1544 2644 S00136402127536662.exe WinMail.exe PID 1544 wrote to memory of 1476 1544 WinMail.exe WinMail.exe PID 1544 wrote to memory of 1476 1544 WinMail.exe WinMail.exe -
outlook_office_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
outlook_win_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\S00136402127536662.exe"C:\Users\Admin\AppData\Local\Temp\S00136402127536662.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qipOGkQWgAPCwF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94CA.tmp"2⤵
- Creates scheduled task(s)
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\S00136402127536662.exe"C:\Users\Admin\AppData\Local\Temp\S00136402127536662.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4060 -
C:\Program Files (x86)\Windows Mail\WinMail.exe"C:\Program Files (x86)\Windows Mail\WinMail" OCInstallUserConfigOE3⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE4⤵PID:1476
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
91b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
MD5
91b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
MD5
055c857272026583a61e1b5821c69a24
SHA1ec39d34f16487682801dd2b319554cbed57feca4
SHA256190db16bb64995e3bdea04b9e6fc1994dacfea3253a7559732205b1d41362b84
SHA512d7833c4651683e95959107e05b07b60d2e963b9fbecd0106b329e2087d1dfc9aedb962b334e22b6b462699cbce86097d4d50ce5d1310ad098e3531efaa4e204b