Analysis
-
max time kernel
158s -
max time network
167s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
16-03-2022 09:28
Static task
static1
Behavioral task
behavioral1
Sample
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe
Resource
win10-20220223-en
General
-
Target
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe
-
Size
817KB
-
MD5
55de296cf36210a101903ad018edddbc
-
SHA1
30857c9cf63be230ed01ad34995b85108f2c9eb9
-
SHA256
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6
-
SHA512
875f0bc9d1ce36a592c9f2211d002919f89f5b9eb8e88ca74a820f6cfdbb56e4ad7e94504db2061f5141e8452118e01c7c8007321299c92543af4a0f9be6d730
Malware Config
Extracted
Protocol: smtp- Host:
mail.dlink.md - Port:
587 - Username:
linkview@dlink.md - Password:
Freemind2k3
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 3884 InstallUtil.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exedescription pid process target process PID 3504 set thread context of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exeInstallUtil.exepid process 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe 3884 InstallUtil.exe 3884 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe Token: SeDebugPrivilege 3884 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exedescription pid process target process PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe PID 3504 wrote to memory of 3884 3504 0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe"C:\Users\Admin\AppData\Local\Temp\0539f85f58cbdfbd5402f02bef84c1ed425122cc95f34c38719d9059343350b6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/3504-119-0x0000000005200000-0x0000000005216000-memory.dmpFilesize
88KB
-
memory/3504-125-0x0000000004810000-0x0000000004816000-memory.dmpFilesize
24KB
-
memory/3504-118-0x0000000005180000-0x00000000051B2000-memory.dmpFilesize
200KB
-
memory/3504-114-0x0000000000470000-0x0000000000542000-memory.dmpFilesize
840KB
-
memory/3504-120-0x000000000B120000-0x000000000B1B2000-memory.dmpFilesize
584KB
-
memory/3504-121-0x0000000004E00000-0x00000000052FE000-memory.dmpFilesize
5.0MB
-
memory/3504-122-0x00000000052B0000-0x00000000052BA000-memory.dmpFilesize
40KB
-
memory/3504-123-0x0000000004E00000-0x00000000052FE000-memory.dmpFilesize
5.0MB
-
memory/3504-124-0x000000000D630000-0x000000000D64A000-memory.dmpFilesize
104KB
-
memory/3504-117-0x0000000005300000-0x00000000057FE000-memory.dmpFilesize
5.0MB
-
memory/3504-126-0x0000000007DC0000-0x0000000008110000-memory.dmpFilesize
3.3MB
-
memory/3504-127-0x0000000008190000-0x00000000081B2000-memory.dmpFilesize
136KB
-
memory/3504-115-0x0000000004D20000-0x0000000004DBC000-memory.dmpFilesize
624KB
-
memory/3504-116-0x00000000738A0000-0x0000000073F8E000-memory.dmpFilesize
6.9MB
-
memory/3884-128-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3884-131-0x0000000005310000-0x0000000005328000-memory.dmpFilesize
96KB
-
memory/3884-132-0x00000000059A0000-0x0000000005A06000-memory.dmpFilesize
408KB
-
memory/3884-133-0x00000000738A0000-0x0000000073F8E000-memory.dmpFilesize
6.9MB
-
memory/3884-134-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB