Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
27-07-2022 21:52
General
-
Target
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe
-
Size
1.4MB
-
MD5
d30ae9e3c1a66b23090622a255dfb918
-
SHA1
e55b120b9cc8cd726365a6360be96a00d8cad60e
-
SHA256
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588
-
SHA512
499402535612aab28a032b432fb594db9636e313dcad28a9df8db3a88b3d3e70b5ddcf37a6c266dd5afbaafa85bdb85955b15feaae51e8863ee7ba56928db1d7
Malware Config
Extracted
bitrat
1.38
103.133.105.50:1234
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Unknown.dll acprotect \Users\Admin\AppData\Local\Temp\Unknown.dll acprotect -
Processes:
resource yara_rule behavioral1/memory/2528-123-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2528-212-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3736-222-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral1/memory/3736-251-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral1/memory/3736-336-0x0000000000400000-0x00000000008DC000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exepid process 4852 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exepid process 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exedescription pid process target process PID 2528 set thread context of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 set thread context of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exepid process 4852 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 4852 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exedescription pid process Token: SeShutdownPrivilege 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe Token: SeDebugPrivilege 4852 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exepid process 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exedescription pid process target process PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 2528 wrote to memory of 3736 2528 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe PID 3736 wrote to memory of 4852 3736 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe 5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe"C:\Users\Admin\AppData\Local\Temp\5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe-a "C:\Users\Admin\AppData\Local\59754af0\plg\MFIvRKpN.json"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5e1f9db033fe27d7a3d646459411c94db634c512844e9eeab40c1b635cac1588.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"3⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\59754af0\plg\MFIvRKpN.jsonFilesize
1KB
MD577e6621fd939338d3f19f3dd948ecf43
SHA153df8b3a76c5d6c35a99aa7759ff3bd7ec46588c
SHA2569cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867
SHA5126e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorFilesize
104B
MD54f3bde9212e17ef18226866d6ac739b6
SHA1732733bec8314beb81437e60876ffa75e72ae6cd
SHA256212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174
SHA51210b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorFilesize
104B
MD5bf5da170f7c9a8eae88d1cb1a191ff80
SHA1dd1b991a1b03587a5d1edc94e919a2070e325610
SHA256e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd
SHA5129e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e
-
C:\Users\Admin\AppData\Local\Temp\Unknown.dllFilesize
793KB
MD586114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
C:\Users\Admin\AppData\Local\Temp\unk.xmlFilesize
1KB
MD577e6621fd939338d3f19f3dd948ecf43
SHA153df8b3a76c5d6c35a99aa7759ff3bd7ec46588c
SHA2569cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867
SHA5126e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f
-
\Users\Admin\AppData\Local\Temp\Unknown.dllFilesize
793KB
MD586114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
memory/2528-152-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-155-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-118-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-119-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-120-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-121-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-122-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-124-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-123-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2528-125-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-126-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-127-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-128-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-129-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-130-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-131-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-132-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-133-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-135-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-134-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-136-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-137-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-138-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-139-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-140-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-141-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-142-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-143-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-145-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-146-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-144-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-147-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-148-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-149-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-150-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-151-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-116-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-153-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-160-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-339-0x0000000073660000-0x000000007369A000-memory.dmpFilesize
232KB
-
memory/2528-117-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-157-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-158-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-159-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-156-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-161-0x00000000734C0000-0x00000000734FA000-memory.dmpFilesize
232KB
-
memory/2528-162-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-163-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-164-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-165-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-166-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-167-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-168-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-169-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-170-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-171-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-172-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-173-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-174-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-175-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-176-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-177-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-178-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-179-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-211-0x0000000073660000-0x000000007369A000-memory.dmpFilesize
232KB
-
memory/2528-212-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2528-338-0x00000000734C0000-0x00000000734FA000-memory.dmpFilesize
232KB
-
memory/2528-114-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-154-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2528-115-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/3736-336-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/3736-222-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/3736-214-0x00000000008D9FE0-mapping.dmp
-
memory/3736-251-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/4852-255-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/4852-309-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/4852-311-0x0000000010000000-0x0000000010227000-memory.dmpFilesize
2.2MB
-
memory/4852-332-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/4852-249-0x00000000006FC1D0-mapping.dmp
-
memory/4852-333-0x0000000010000000-0x0000000010227000-memory.dmpFilesize
2.2MB