Analysis
-
max time kernel
74s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 15:03
Static task
static1
Behavioral task
behavioral1
Sample
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe
Resource
win10v2004-20220414-en
General
-
Target
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe
-
Size
292KB
-
MD5
5652ed4384e659acec44f9ab3babc6e8
-
SHA1
576d278d6fa40f54e16a3ac89284e074473da642
-
SHA256
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a
-
SHA512
b3bfebfff3a8b1d64d82eea2471e6fcc13074f311a0f7f1e7c10f2fd6029f7b8742b3ee845c21f754824175259c2c70ccb0bb25e3e4b85e4fd0a60740d2a4823
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exedescription pid process target process PID 288 set thread context of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exepid process 828 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 828 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exedescription pid process Token: SeDebugPrivilege 828 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exedescription pid process target process PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe PID 288 wrote to memory of 828 288 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe -
outlook_office_path 1 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe -
outlook_win_path 1 IoCs
Processes:
12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe"C:\Users\Admin\AppData\Local\Temp\12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe"C:\Users\Admin\AppData\Local\Temp\12971c228512d222498e24ad1a5aad8464e43738a86807686240863ae208452a.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-66-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB
-
memory/288-55-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB
-
memory/288-73-0x0000000072980000-0x0000000073478000-memory.dmpFilesize
11.0MB
-
memory/288-71-0x0000000073760000-0x00000000738FB000-memory.dmpFilesize
1.6MB
-
memory/288-69-0x0000000072980000-0x0000000073478000-memory.dmpFilesize
11.0MB
-
memory/288-70-0x0000000073900000-0x000000007409C000-memory.dmpFilesize
7.6MB
-
memory/288-54-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/828-62-0x0000000000433F9E-mapping.dmp
-
memory/828-74-0x00000000727F0000-0x0000000072978000-memory.dmpFilesize
1.5MB
-
memory/828-60-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-59-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-57-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-72-0x0000000073900000-0x000000007409C000-memory.dmpFilesize
7.6MB
-
memory/828-56-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/828-75-0x0000000071C10000-0x00000000727EE000-memory.dmpFilesize
11.9MB
-
memory/828-76-0x0000000071920000-0x0000000071A24000-memory.dmpFilesize
1.0MB
-
memory/828-77-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB
-
memory/828-78-0x0000000072980000-0x0000000073478000-memory.dmpFilesize
11.0MB
-
memory/828-79-0x0000000073760000-0x00000000738FB000-memory.dmpFilesize
1.6MB
-
memory/828-80-0x0000000071A30000-0x0000000071A6A000-memory.dmpFilesize
232KB
-
memory/828-81-0x0000000071920000-0x0000000071A24000-memory.dmpFilesize
1.0MB
-
memory/828-82-0x0000000071820000-0x0000000071911000-memory.dmpFilesize
964KB
-
memory/828-83-0x00000000712E0000-0x0000000071816000-memory.dmpFilesize
5.2MB