outsteel | b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43

Analysis

max time kernel
134s
max time network
146s
platform
windows7_x64
resource
win7-en-20211208
submitted
28/02/2022, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
Size 634KB
Sample220228-dv2f2sdac6
SHA256 b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43
MD5 d4fa9c88bd43d2b9bcb66c3e7292b52a
SHA1 5cf627b7cc836506958a5e04e902f8530cdb58b6
SHA512 2088445e2dd2e9497c97acb7ad426536c2d190014702fd4c77193193db42cedbb9dcae918e37ce4161393a4043f36e76ff2947e0276fe4647b38478725d03919
MD5 SHA1 SHA512

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\t:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\u:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\x:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\y:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\b:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\p:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\g:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\h:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\l:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\m:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\o:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\z:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\a:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\e:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\s:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\f:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\r:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\k:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\n:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\v:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\w:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\i:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
File opened (read-only)	\??\j:	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/432-58-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/432-60-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 1588 wrote to memory of 432	1588	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	27
PID 432 wrote to memory of 872	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	28
PID 432 wrote to memory of 872	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	28
PID 432 wrote to memory of 872	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	28
PID 432 wrote to memory of 872	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	28
PID 432 wrote to memory of 1108	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	30
PID 432 wrote to memory of 1108	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	30
PID 432 wrote to memory of 1108	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	30
PID 432 wrote to memory of 1108	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	30
PID 432 wrote to memory of 1464	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	32
PID 432 wrote to memory of 1464	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	32
PID 432 wrote to memory of 1464	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	32
PID 432 wrote to memory of 1464	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	32
PID 432 wrote to memory of 1276	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	34
PID 432 wrote to memory of 1276	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	34
PID 432 wrote to memory of 1276	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	34
PID 432 wrote to memory of 1276	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	34
PID 432 wrote to memory of 808	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	36
PID 432 wrote to memory of 808	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	36
PID 432 wrote to memory of 808	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	36
PID 432 wrote to memory of 808	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	36
PID 432 wrote to memory of 640	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	38
PID 432 wrote to memory of 640	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	38
PID 432 wrote to memory of 640	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	38
PID 432 wrote to memory of 640	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	38
PID 432 wrote to memory of 1644	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	40
PID 432 wrote to memory of 1644	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	40
PID 432 wrote to memory of 1644	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	40
PID 432 wrote to memory of 1644	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	40
PID 432 wrote to memory of 1120	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	42
PID 432 wrote to memory of 1120	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	42
PID 432 wrote to memory of 1120	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	42
PID 432 wrote to memory of 1120	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	42
PID 432 wrote to memory of 1188	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	44
PID 432 wrote to memory of 1188	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	44
PID 432 wrote to memory of 1188	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	44
PID 432 wrote to memory of 1188	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	44
PID 432 wrote to memory of 1412	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	46
PID 432 wrote to memory of 1412	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	46
PID 432 wrote to memory of 1412	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	46
PID 432 wrote to memory of 1412	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	46
PID 432 wrote to memory of 536	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	48
PID 432 wrote to memory of 536	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	48
PID 432 wrote to memory of 536	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	48
PID 432 wrote to memory of 536	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	48
PID 432 wrote to memory of 1152	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	50
PID 432 wrote to memory of 1152	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	50
PID 432 wrote to memory of 1152	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	50
PID 432 wrote to memory of 1152	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	50
PID 432 wrote to memory of 1480	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	52
PID 432 wrote to memory of 1480	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	52
PID 432 wrote to memory of 1480	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	52
PID 432 wrote to memory of 1480	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	52
PID 432 wrote to memory of 2036	432	b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe	54

C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
"C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
  C:\Users\Admin\AppData\Local\Temp\b8ce958f56087c6cd55fa2131a1cd3256063e7c73adf36af313054b0f17b7b43.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
    3⤵
    PID:872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
    3⤵
    PID:808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
    3⤵
    PID:640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
    3⤵
    PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
    3⤵
    PID:604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A
    3⤵
    PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-58-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/432-59-0x0000000075191000-0x0000000075193000-memory.dmp

Download

memory/432-60-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/1588-54-0x0000000073DAE000-0x0000000073DAF000-memory.dmp

Download

memory/1588-55-0x0000000000A80000-0x0000000000B22000-memory.dmp

Download

memory/1588-56-0x0000000001F50000-0x0000000001F51000-memory.dmp

Download

memory/1588-57-0x0000000000570000-0x0000000000584000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads