b44db0bf0992d55c7353fe368322fe0b1e912b2a381c4bf8b7c56c9fcd2a86ff

General

Target
3a862bf59180e674d02181fb2c8b3993.exe
Size 2.0MB
Sample220123-vxkpragcd5
SHA256 b44db0bf0992d55c7353fe368322fe0b1e912b2a381c4bf8b7c56c9fcd2a86ff
MD5 3a862bf59180e674d02181fb2c8b3993
SHA1 808586b938fd8f5601f1d6533ca0e98aa34c0d93
SHA512 4fcda7da5548ddb6391217711bb590d7b3c213af6b4e9c93f536b74a81c97b5d9e5005ea21fab30a7c41b3fffb8e1ddead56fac5f5cf73ce38eefc42d665bed0
MD5 SHA1 SHA512

Score

7^/10

collection spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3a862bf59180e674d02181fb2c8b3993.exe
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3a862bf59180e674d02181fb2c8b3993.exe
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3a862bf59180e674d02181fb2c8b3993.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	checkip.amazonaws.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	3a862bf59180e674d02181fb2c8b3993.exe
4108	3a862bf59180e674d02181fb2c8b3993.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69
PID 3828 wrote to memory of 4108	3828	3a862bf59180e674d02181fb2c8b3993.exe	69

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3a862bf59180e674d02181fb2c8b3993.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3a862bf59180e674d02181fb2c8b3993.exe

C:\Users\Admin\AppData\Local\Temp\3a862bf59180e674d02181fb2c8b3993.exe
"C:\Users\Admin\AppData\Local\Temp\3a862bf59180e674d02181fb2c8b3993.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\3a862bf59180e674d02181fb2c8b3993.exe
  "C:\Users\Admin\AppData\Local\Temp\3a862bf59180e674d02181fb2c8b3993.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  - outlook_win_path
  PID:4108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

5

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-116-0x0000000000D10000-0x0000000000EDB000-memory.dmp

Download

memory/3828-117-0x0000000000EE0000-0x00000000011D4000-memory.dmp

Download

memory/4108-115-0x0000000000400000-0x00000000006F5000-memory.dmp

Download

memory/4108-118-0x0000000000400000-0x00000000006F5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads