Overview

overview

10

Static

static

New Inquir...20.exe

windows7_x64

10

New Inquir...20.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    113s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 22:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Inquiry-08312020.exe

  • Size

    1.2MB

  • MD5

    930f62764aa710a930de8d85abb9f25f

  • SHA1

    23b090662b3deaadf4e1db64849f8eee06e18a36

  • SHA256

    de00e60ea65a5c4f7804c137b07d6973bdf8fc17ca192035b7976362e978a8d2

  • SHA512

    408f2f2eea634b2fa12f50c22b1da4fe9d6703e245a3a549a080707bf01cb4997578ee3f62a2530c2527eeb355b8aebd871ec25b7fa46107684f30cd08a101e0

Score
7/10
collectionspywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Inquiry-08312020.exe
    "C:\Users\Admin\AppData\Local\Temp\New Inquiry-08312020.exe"
    1⤵
    • Checks computer location settings
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • outlook_office_path
    • outlook_win_path
    PID:4288

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4288-130-0x0000000000190000-0x00000000002BE000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4288-131-0x0000000004B10000-0x0000000004BAC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4288-132-0x0000000005160000-0x0000000005704000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4288-133-0x0000000004C50000-0x0000000004CE2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4288-134-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4288-135-0x0000000004CF0000-0x0000000004D46000-memory.dmp

    Filesize

    344KB

    Download

  • memory/4288-136-0x00000000069F0000-0x0000000006A56000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4288-137-0x0000000007200000-0x0000000007250000-memory.dmp

    Filesize

    320KB

    Download