Analysis
- max time kernel
121s - max time network
140s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 22:35
General
- Target 07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0.exe
- Size 287KB
- Sample220128-2hrm3sfff4
- SHA256 07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0
Malware Config
Signatures
- Phoenix Keylogger
Phoenix is a keylogger and info stealer first seen in July 2019.
- Phoenix Keylogger Payload 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0.exe"C:\Users\Admin\AppData\Local\Temp\07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0.exe"C:\Users\Admin\AppData\Local\Temp\07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-128-0x00000000005D0000-0x00000000005F4000-memory.dmp
memory/872-133-0x0000000004F43000-0x0000000004F45000-memory.dmp
memory/872-132-0x00000000069E0000-0x0000000006BA2000-memory.dmp
memory/872-131-0x0000000006540000-0x000000000654A000-memory.dmp
memory/872-130-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/872-129-0x0000000004ED0000-0x0000000004F08000-memory.dmp
memory/2644-121-0x0000000004E70000-0x0000000004E78000-memory.dmp
memory/2644-125-0x0000000007CC0000-0x0000000007D26000-memory.dmp
memory/2644-126-0x0000000005390000-0x000000000539A000-memory.dmp
memory/2644-124-0x0000000004EC0000-0x00000000053BE000-memory.dmp
memory/2644-123-0x00000000050A0000-0x00000000050D8000-memory.dmp
memory/2644-122-0x0000000005000000-0x000000000509C000-memory.dmp
memory/2644-118-0x0000000000670000-0x00000000006BE000-memory.dmp
memory/2644-120-0x0000000004F60000-0x0000000004FF2000-memory.dmp
memory/2644-119-0x00000000053C0000-0x00000000058BE000-memory.dmp