Overview

overview

10

Static

static

bce9a96a4a...3e.exe

windows7-x64

10

bce9a96a4a...3e.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    124s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 06:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe

  • Size

    707KB

  • MD5

    8583911291b5a5fa27f0930d403e8128

  • SHA1

    a88e96b6c8cab8106c812b1aa3853f3c60c7f153

  • SHA256

    bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e

  • SHA512

    d2740da3d3e95cdf01a685e70f85bf6445896c1005ab9da4f22bff6e0c57163d8ffbc6f23597622efa314b7a89c5a7c42f9bd991b96bfb03d4aec744f6b23663

Score
10/10
phoenixcollectionkeyloggerspywarestealer

Malware Config

Signatures

  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

    stealerkeyloggerphoenix
  • Phoenix Keylogger payload 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe
    "C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe
      "bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe"
      2⤵
        PID:1484
      • C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe
        "bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe"
        2⤵
          PID:1448
        • C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe
          "bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe"
          2⤵
            PID:1252
          • C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe
            "bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe"
            2⤵
              PID:996
            • C:\Users\Admin\AppData\Local\Temp\bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe
              "bce9a96a4a27ae4cdc4ffd84249b7e6e075810952120874f6dbebc39d586bb3e.exe"
              2⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • outlook_office_path
              • outlook_win_path
              PID:956

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Credentials in Files

          2
          T1081

          Discovery

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Email Collection

          1
          T1114

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/956-57-0x000000000041EA4E-mapping.dmp
            Download
          • memory/956-58-0x0000000000400000-0x0000000000422000-memory.dmp
            Filesize

            136KB

            Download
          • memory/956-59-0x00000000002A0000-0x00000000002D6000-memory.dmp
            Filesize

            216KB

            Download
          • memory/956-62-0x0000000004A35000-0x0000000004A46000-memory.dmp
            Filesize

            68KB

            Download
          • memory/1400-54-0x0000000000020000-0x00000000000D8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1400-55-0x00000000004D0000-0x00000000004FC000-memory.dmp
            Filesize

            176KB

            Download
          • memory/1400-56-0x0000000075B81000-0x0000000075B83000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1400-60-0x0000000000510000-0x0000000000513000-memory.dmp
            Filesize

            12KB

            Download