Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
25/06/2022, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe
- Size 393KB
- Sample220625-lfc4xaegcl
- SHA256 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb
- MD5 eaeb04b6dc6760d80287cc151ff650f5
- SHA1 e2ca75658e9f6b420a81d84e1d4521f172232a8e
- SHA512 ef7635f157068606ebe9823efd3a59dc7e4e5ea4742d5ee3f3f26d5b3987665e988f77cc2911c65f0abd1360ef8abbda3d466b0d9749a8416d950894e6f18bbf
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 checkip.dyndns.org - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3036 wrote to memory of 3456 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 90 PID 3036 wrote to memory of 3456 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 90 PID 3036 wrote to memory of 3456 3036 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe 90 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe"C:\Users\Admin\AppData\Local\Temp\d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe"1⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3036 -
C:\Windows\SysWOW64\cmd.execmd /C copy "C:\Users\Admin\AppData\Local\Temp\d32095056ea09bf505c9106e88d44a71e3793cca501acf7c46fb0f478faf50fb.exe" C:\Users\Admin2⤵PID:3456
-