Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
04-11-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
doc3723636638837373344.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
doc3723636638837373344.exe
Resource
win10-en-20210920
General
-
Target
doc3723636638837373344.exe
-
Size
546KB
-
MD5
bb0f727180c9b29e51c9ab2a9b4c539c
-
SHA1
ccd4d7a83603d2471aabb0caf2e1196b9193b586
-
SHA256
2b6b5926ec7e5d6acea355bbd8f43a89850ed85e0c3739edfad2608ead9f1573
-
SHA512
ce0670de14582f900b89149cb63fdfe171d188a1a7752d72ed068e57775c54557817acd09148d93725bd52456ed901de8e6b6d0fec0d064b24b46fa8dab7e5d5
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
mail.yekamuhendislik.com - Port:
587 - Username:
muhasebe@yekamuhendislik.com - Password:
MuhasebE123*
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
BluStealer
A Modular information stealer written in Visual Basic.
-
A310logger Executable 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger -
Executes dropped EXE 1 IoCs
Processes:
Fox.exepid process 1148 Fox.exe -
Loads dropped DLL 1 IoCs
Processes:
doc3723636638837373344.exepid process 1120 doc3723636638837373344.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
doc3723636638837373344.exedescription pid process target process PID 1764 set thread context of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
doc3723636638837373344.exepid process 1764 doc3723636638837373344.exe 1764 doc3723636638837373344.exe 1764 doc3723636638837373344.exe 1764 doc3723636638837373344.exe 1764 doc3723636638837373344.exe 1764 doc3723636638837373344.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
doc3723636638837373344.exedescription pid process Token: SeDebugPrivilege 1764 doc3723636638837373344.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
doc3723636638837373344.exepid process 1120 doc3723636638837373344.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
doc3723636638837373344.exedoc3723636638837373344.exedescription pid process target process PID 1764 wrote to memory of 1280 1764 doc3723636638837373344.exe schtasks.exe PID 1764 wrote to memory of 1280 1764 doc3723636638837373344.exe schtasks.exe PID 1764 wrote to memory of 1280 1764 doc3723636638837373344.exe schtasks.exe PID 1764 wrote to memory of 1280 1764 doc3723636638837373344.exe schtasks.exe PID 1764 wrote to memory of 1556 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1556 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1556 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1556 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1764 wrote to memory of 1120 1764 doc3723636638837373344.exe doc3723636638837373344.exe PID 1120 wrote to memory of 1148 1120 doc3723636638837373344.exe Fox.exe PID 1120 wrote to memory of 1148 1120 doc3723636638837373344.exe Fox.exe PID 1120 wrote to memory of 1148 1120 doc3723636638837373344.exe Fox.exe PID 1120 wrote to memory of 1148 1120 doc3723636638837373344.exe Fox.exe -
outlook_office_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
outlook_win_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc3723636638837373344.exe"C:\Users\Admin\AppData\Local\Temp\doc3723636638837373344.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ARXXSy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8DD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\doc3723636638837373344.exe"C:\Users\Admin\AppData\Local\Temp\doc3723636638837373344.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\doc3723636638837373344.exe"C:\Users\Admin\AppData\Local\Temp\doc3723636638837373344.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeMD5
91b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeMD5
91b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeMD5
91b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
memory/1120-68-0x0000000000090000-0x0000000000096000-memory.dmpFilesize
24KB
-
memory/1120-71-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1120-69-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/1120-62-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1120-63-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1120-64-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1120-66-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1120-67-0x0000000000401B9C-mapping.dmp
-
memory/1148-73-0x0000000000000000-mapping.dmp
-
memory/1148-76-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1148-78-0x000000001B150000-0x000000001B152000-memory.dmpFilesize
8KB
-
memory/1280-61-0x0000000000000000-mapping.dmp
-
memory/1764-60-0x0000000004EF0000-0x0000000004F69000-memory.dmpFilesize
484KB
-
memory/1764-59-0x00000000003A0000-0x00000000003A6000-memory.dmpFilesize
24KB
-
memory/1764-55-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1764-58-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1764-57-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB