Overview
overview
10Static
static
NewCovid-2...21.exe
windows7_x64
10NewCovid-2...21.exe
windows10-2004_x64
10NewCovid-2...ed.pdf
windows7_x64
1NewCovid-2...ed.pdf
windows10-2004_x64
1NewCovid-2...er.lnk
windows7_x64
10NewCovid-2...er.lnk
windows10-2004_x64
10NewCovid-2...ic.rtf
windows7_x64
8NewCovid-2...ic.rtf
windows10-2004_x64
1Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-02-2022 03:16
Static task
static1
Behavioral task
behavioral1
Sample
NewCovid-21/08042021.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NewCovid-21/08042021.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
NewCovid-21/GEO-CFUND-2009_CCM Agreement_Facesheet - signed.pdf
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
NewCovid-21/GEO-CFUND-2009_CCM Agreement_Facesheet - signed.pdf
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
NewCovid-21/New Folder.lnk
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
NewCovid-21/New Folder.lnk
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
NewCovid-21/Statistic.rtf
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
NewCovid-21/Statistic.rtf
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Malware Config
Signatures
-
OutSteel batch script 1 IoCs
Detects batch script dropped by OutSteel
resource yara_rule behavioral1/files/0x000400000000b1f2-60.dat outsteel_batch_script -
Deletes itself 1 IoCs
pid Process 968 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: 08042021.exe File opened (read-only) \??\n: 08042021.exe File opened (read-only) \??\p: 08042021.exe File opened (read-only) \??\w: 08042021.exe File opened (read-only) \??\x: 08042021.exe File opened (read-only) \??\a: 08042021.exe File opened (read-only) \??\b: 08042021.exe File opened (read-only) \??\g: 08042021.exe File opened (read-only) \??\z: 08042021.exe File opened (read-only) \??\i: 08042021.exe File opened (read-only) \??\k: 08042021.exe File opened (read-only) \??\y: 08042021.exe File opened (read-only) \??\o: 08042021.exe File opened (read-only) \??\r: 08042021.exe File opened (read-only) \??\v: 08042021.exe File opened (read-only) \??\h: 08042021.exe File opened (read-only) \??\l: 08042021.exe File opened (read-only) \??\m: 08042021.exe File opened (read-only) \??\s: 08042021.exe File opened (read-only) \??\t: 08042021.exe File opened (read-only) \??\u: 08042021.exe File opened (read-only) \??\e: 08042021.exe File opened (read-only) \??\f: 08042021.exe File opened (read-only) \??\q: 08042021.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1628-57-0x00000000044A0000-0x000000000457D000-memory.dmp autoit_exe behavioral1/memory/1628-59-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Kills process with taskkill 1 IoCs
pid Process 788 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 788 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1704 1628 08042021.exe 27 PID 1628 wrote to memory of 1704 1628 08042021.exe 27 PID 1628 wrote to memory of 1704 1628 08042021.exe 27 PID 1628 wrote to memory of 1704 1628 08042021.exe 27 PID 1628 wrote to memory of 544 1628 08042021.exe 29 PID 1628 wrote to memory of 544 1628 08042021.exe 29 PID 1628 wrote to memory of 544 1628 08042021.exe 29 PID 1628 wrote to memory of 544 1628 08042021.exe 29 PID 1628 wrote to memory of 1636 1628 08042021.exe 31 PID 1628 wrote to memory of 1636 1628 08042021.exe 31 PID 1628 wrote to memory of 1636 1628 08042021.exe 31 PID 1628 wrote to memory of 1636 1628 08042021.exe 31 PID 1628 wrote to memory of 784 1628 08042021.exe 33 PID 1628 wrote to memory of 784 1628 08042021.exe 33 PID 1628 wrote to memory of 784 1628 08042021.exe 33 PID 1628 wrote to memory of 784 1628 08042021.exe 33 PID 1628 wrote to memory of 956 1628 08042021.exe 35 PID 1628 wrote to memory of 956 1628 08042021.exe 35 PID 1628 wrote to memory of 956 1628 08042021.exe 35 PID 1628 wrote to memory of 956 1628 08042021.exe 35 PID 1628 wrote to memory of 592 1628 08042021.exe 37 PID 1628 wrote to memory of 592 1628 08042021.exe 37 PID 1628 wrote to memory of 592 1628 08042021.exe 37 PID 1628 wrote to memory of 592 1628 08042021.exe 37 PID 1628 wrote to memory of 856 1628 08042021.exe 39 PID 1628 wrote to memory of 856 1628 08042021.exe 39 PID 1628 wrote to memory of 856 1628 08042021.exe 39 PID 1628 wrote to memory of 856 1628 08042021.exe 39 PID 1628 wrote to memory of 1768 1628 08042021.exe 41 PID 1628 wrote to memory of 1768 1628 08042021.exe 41 PID 1628 wrote to memory of 1768 1628 08042021.exe 41 PID 1628 wrote to memory of 1768 1628 08042021.exe 41 PID 1628 wrote to memory of 1208 1628 08042021.exe 43 PID 1628 wrote to memory of 1208 1628 08042021.exe 43 PID 1628 wrote to memory of 1208 1628 08042021.exe 43 PID 1628 wrote to memory of 1208 1628 08042021.exe 43 PID 1628 wrote to memory of 1292 1628 08042021.exe 45 PID 1628 wrote to memory of 1292 1628 08042021.exe 45 PID 1628 wrote to memory of 1292 1628 08042021.exe 45 PID 1628 wrote to memory of 1292 1628 08042021.exe 45 PID 1628 wrote to memory of 912 1628 08042021.exe 47 PID 1628 wrote to memory of 912 1628 08042021.exe 47 PID 1628 wrote to memory of 912 1628 08042021.exe 47 PID 1628 wrote to memory of 912 1628 08042021.exe 47 PID 1628 wrote to memory of 1736 1628 08042021.exe 49 PID 1628 wrote to memory of 1736 1628 08042021.exe 49 PID 1628 wrote to memory of 1736 1628 08042021.exe 49 PID 1628 wrote to memory of 1736 1628 08042021.exe 49 PID 1628 wrote to memory of 1076 1628 08042021.exe 51 PID 1628 wrote to memory of 1076 1628 08042021.exe 51 PID 1628 wrote to memory of 1076 1628 08042021.exe 51 PID 1628 wrote to memory of 1076 1628 08042021.exe 51 PID 1628 wrote to memory of 1744 1628 08042021.exe 53 PID 1628 wrote to memory of 1744 1628 08042021.exe 53 PID 1628 wrote to memory of 1744 1628 08042021.exe 53 PID 1628 wrote to memory of 1744 1628 08042021.exe 53 PID 1628 wrote to memory of 1948 1628 08042021.exe 55 PID 1628 wrote to memory of 1948 1628 08042021.exe 55 PID 1628 wrote to memory of 1948 1628 08042021.exe 55 PID 1628 wrote to memory of 1948 1628 08042021.exe 55 PID 1628 wrote to memory of 2020 1628 08042021.exe 57 PID 1628 wrote to memory of 2020 1628 08042021.exe 57 PID 1628 wrote to memory of 2020 1628 08042021.exe 57 PID 1628 wrote to memory of 2020 1628 08042021.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewCovid-21\08042021.exe"C:\Users\Admin\AppData\Local\Temp\NewCovid-21\08042021.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A2⤵PID:544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A2⤵PID:956
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:1768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A2⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A2⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A2⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A2⤵PID:1736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A2⤵PID:1076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A2⤵PID:1744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A2⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A2⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A2⤵PID:1444
-
-
C:\Windows\SysWOW64\cmd.execmd /c start /min r.bat2⤵PID:748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K r.bat3⤵
- Deletes itself
PID:968 -
C:\Windows\SysWOW64\cmd.execmd /min /c del "C:\Users\Admin\AppData\Local\Temp\NewCovid-21\r.bat"4⤵PID:768
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /IM cmd.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
-