Analysis
-
max time kernel
124s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 16:37
General
-
Target
1b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700.exe
-
Size
2.3MB
-
MD5
ae91c9d85c89ea2ec6bca35dac6262a1
-
SHA1
57a5e54e8c321b2bd55d0cf77bf2a8097710a6c6
-
SHA256
1b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700
-
SHA512
2a784c727de7df1f2de42f1b9a7eaeb993437714568aaa75e078fa7e7b87feefeb8a6af858b188ca550330af9d89d79c83c0485c311fa2ebca395d0e6ca1b454
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700.exe"C:\Users\Admin\AppData\Local\Temp\1b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4F97.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
12KB
MD51708cc89b5b398b88e15af47c61a5303
SHA16f07ec6867f3dc598991b2d3d58672ce6af136d7
SHA256a7af10111d80a26f936258f7e665cece3d0bd31effd1126e19e2b9e1afbbefe8
SHA5125fb8ac14887115075334152a35364b6f29c65924bb71e3c8b0a7d149d13b7ab7ecce8a0304ad151ababc04113a471b2340a52f0cc4835f389caf26919fb464c8
-
Filesize
18KB
MD5ee6995a219cd19f357ce923ad6725541
SHA1ce297fff0ccdcb94744c4b470420c9dfcdcec640
SHA256e18df4fd6029e3ef94e63b822f45ba9939088abbf4dcec5b3d9b299939bc48bf
SHA512566d00d177ab7593124f93c75e16bc50f7b4d59486d05fbaf50ddf0cc52c4e7412b128ddf95e0d9ac4862f43010bd2704ca5b48a0c85da6a5f936e75d52083d7
-
Filesize
158B
MD5c55aaf6c5e27e673f8032442a84a92fa
SHA1228c5aa5ace8ba9434b372edb10aac60c1bb0fa2
SHA256d3d7c6d6c6809935f699c5e927f8597a8b1a6298d456eaa72d6eb9124c8e5194
SHA512a08935c3623bccfe0f29f955ac19ca53601c4472c8853c61db698d27353782a4f7a50f7134fe2aced6e8e7602f4876eff8f69558eb8efd0bd901cb6bd60a2ea3
-
Filesize
2.3MB
MD5ae91c9d85c89ea2ec6bca35dac6262a1
SHA157a5e54e8c321b2bd55d0cf77bf2a8097710a6c6
SHA2561b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700
SHA5122a784c727de7df1f2de42f1b9a7eaeb993437714568aaa75e078fa7e7b87feefeb8a6af858b188ca550330af9d89d79c83c0485c311fa2ebca395d0e6ca1b454
-
Filesize
2.3MB
MD5ae91c9d85c89ea2ec6bca35dac6262a1
SHA157a5e54e8c321b2bd55d0cf77bf2a8097710a6c6
SHA2561b249c58ecd6142ceb97e78122ed1bd77d768d5be2ca58138bf0c6ce4c946700
SHA5122a784c727de7df1f2de42f1b9a7eaeb993437714568aaa75e078fa7e7b87feefeb8a6af858b188ca550330af9d89d79c83c0485c311fa2ebca395d0e6ca1b454
-
Filesize
304KB
-
Filesize
56KB
-
-
Filesize
8KB
-
-
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
8KB
-
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
320KB
-
-
-
Filesize
8KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
216KB
-