Analysis
-
max time kernel
4294181s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
28-02-2022 03:11
Static task
static1
Behavioral task
behavioral1
Sample
3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe
Resource
win7-20220223-en
General
-
Target
3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe
-
Size
598KB
-
MD5
45abce50a00d40dff21edb7264824758
-
SHA1
0861d2abbcf16bf6394dc7aadd341b348a3c8c4d
-
SHA256
3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c
-
SHA512
7097f34634f716609bc4bbe27af511a9fec24c555c25c22e712f3ce019b471328226030bb2939692f36a81cc24de105670b263d0fb7036375e60c8ddaee2a8f6
Malware Config
Signatures
-
OutSteel batch script 1 IoCs
Detects batch script dropped by OutSteel
resource yara_rule behavioral1/files/0x0004000000004ed7-59.dat outsteel_batch_script -
Deletes itself 1 IoCs
pid Process 1948 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\t: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\u: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\w: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\y: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\k: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\n: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\p: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\l: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\q: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\x: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\b: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\e: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\i: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\v: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\f: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\g: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\r: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\m: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\o: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\z: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\a: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\h: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe File opened (read-only) \??\j: 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1236-57-0x0000000000300000-0x00000000003DD000-memory.dmp autoit_exe behavioral1/memory/1236-58-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Kills process with taskkill 1 IoCs
pid Process 1912 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1912 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 1612 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 27 PID 1236 wrote to memory of 1612 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 27 PID 1236 wrote to memory of 1612 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 27 PID 1236 wrote to memory of 1612 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 27 PID 1236 wrote to memory of 564 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 29 PID 1236 wrote to memory of 564 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 29 PID 1236 wrote to memory of 564 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 29 PID 1236 wrote to memory of 564 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 29 PID 1236 wrote to memory of 240 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 31 PID 1236 wrote to memory of 240 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 31 PID 1236 wrote to memory of 240 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 31 PID 1236 wrote to memory of 240 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 31 PID 1236 wrote to memory of 620 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 33 PID 1236 wrote to memory of 620 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 33 PID 1236 wrote to memory of 620 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 33 PID 1236 wrote to memory of 620 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 33 PID 1236 wrote to memory of 1892 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 35 PID 1236 wrote to memory of 1892 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 35 PID 1236 wrote to memory of 1892 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 35 PID 1236 wrote to memory of 1892 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 35 PID 1236 wrote to memory of 1960 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 37 PID 1236 wrote to memory of 1960 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 37 PID 1236 wrote to memory of 1960 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 37 PID 1236 wrote to memory of 1960 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 37 PID 1236 wrote to memory of 1912 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 39 PID 1236 wrote to memory of 1912 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 39 PID 1236 wrote to memory of 1912 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 39 PID 1236 wrote to memory of 1912 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 39 PID 1236 wrote to memory of 824 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 41 PID 1236 wrote to memory of 824 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 41 PID 1236 wrote to memory of 824 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 41 PID 1236 wrote to memory of 824 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 41 PID 1236 wrote to memory of 840 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 43 PID 1236 wrote to memory of 840 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 43 PID 1236 wrote to memory of 840 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 43 PID 1236 wrote to memory of 840 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 43 PID 1236 wrote to memory of 1720 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 45 PID 1236 wrote to memory of 1720 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 45 PID 1236 wrote to memory of 1720 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 45 PID 1236 wrote to memory of 1720 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 45 PID 1236 wrote to memory of 1004 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 47 PID 1236 wrote to memory of 1004 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 47 PID 1236 wrote to memory of 1004 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 47 PID 1236 wrote to memory of 1004 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 47 PID 1236 wrote to memory of 1520 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 49 PID 1236 wrote to memory of 1520 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 49 PID 1236 wrote to memory of 1520 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 49 PID 1236 wrote to memory of 1520 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 49 PID 1236 wrote to memory of 1684 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 51 PID 1236 wrote to memory of 1684 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 51 PID 1236 wrote to memory of 1684 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 51 PID 1236 wrote to memory of 1684 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 51 PID 1236 wrote to memory of 1704 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 53 PID 1236 wrote to memory of 1704 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 53 PID 1236 wrote to memory of 1704 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 53 PID 1236 wrote to memory of 1704 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 53 PID 1236 wrote to memory of 560 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 55 PID 1236 wrote to memory of 560 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 55 PID 1236 wrote to memory of 560 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 55 PID 1236 wrote to memory of 560 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 55 PID 1236 wrote to memory of 1856 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 57 PID 1236 wrote to memory of 1856 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 57 PID 1236 wrote to memory of 1856 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 57 PID 1236 wrote to memory of 1856 1236 3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe"C:\Users\Admin\AppData\Local\Temp\3f7b0d15f4cbe63e57fb06b57575bf6dd9eb777c737b0886250166768169fc6c.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A2⤵PID:1612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A2⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:620
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A2⤵PID:1892
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:824
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A2⤵PID:840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A2⤵PID:1720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A2⤵PID:1004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A2⤵PID:1520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A2⤵PID:1684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A2⤵PID:560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A2⤵PID:1856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A2⤵PID:1328
-
-
C:\Windows\SysWOW64\cmd.execmd /c start /min r.bat2⤵PID:1944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K r.bat3⤵
- Deletes itself
PID:1948 -
C:\Windows\SysWOW64\cmd.execmd /min /c del "C:\Users\Admin\AppData\Local\Temp\r.bat"4⤵PID:1152
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /IM cmd.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
-