outsteel | 9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f

General

Target

9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
Size

666KB
MD5

7910a78498cb7953b1c0db2ef4f8db27
SHA1

8f61608330261c1d5214f5d19f98b4d64f51ac12
SHA256

9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f
SHA512

fd60d2c922c58906065816d347faf484a7ebfde81e354ca387dffbaf40f07c2ffae7884b702cf709b2f91468848ac132ba3310ec1f081cf1c363c8dea9bc4b7e

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe

description	ioc	process
File opened (read-only)	\??\g:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\h:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\o:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\q:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\s:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\y:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\z:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\b:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\f:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\i:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\j:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\k:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\x:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\a:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\l:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\u:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\v:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\w:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\e:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\m:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\n:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\p:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\r:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
File opened (read-only)	\??\t:	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/964-57-0x0000000000C70000-0x0000000000D4D000-memory.dmp	autoit_exe
behavioral1/memory/964-58-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe

description	pid	process	target process
PID 964 wrote to memory of 756	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 756	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 756	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 756	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1140	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1140	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1140	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1140	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1580	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1580	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1580	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1580	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 568	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 568	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 568	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 568	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 596	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 596	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 596	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 596	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1412	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1412	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1412	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1412	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 532	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 532	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 532	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 532	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1896	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1896	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1896	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1896	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1464	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1464	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1464	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1464	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 920	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 920	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 920	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 920	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 2012	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 2012	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 2012	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 2012	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 912	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 912	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 912	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 912	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1704	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1704	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1704	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1704	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1332	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1332	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1332	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1332	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1804	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1804	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1804	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1804	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1980	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1980	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1980	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe
PID 964 wrote to memory of 1980	964	9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe
"C:\Users\Admin\AppData\Local\Temp\9528a97d8d73b0dbed2ac496991f0a2eecc5a857d22e994d227ae7c3bef7296f.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:1464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x00000000002BA000-0x0000000000335000-memory.dmp

Filesize
492KB

Download
memory/964-55-0x00000000762A1000-0x00000000762A3000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x00000000002BA000-0x0000000000335000-memory.dmp

Filesize
492KB

Download
memory/964-57-0x0000000000C70000-0x0000000000D4D000-memory.dmp

Filesize
884KB

Download
memory/964-58-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads