4ae67a52de5f2bcaea6c9158b4b2dfd3b2953885c34063547b736a4a1096fcb2

Analysis

max time kernel
115s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update_0129863793.exe
Size 673KB
Sample221010-3w971sefe3
SHA256 4ae67a52de5f2bcaea6c9158b4b2dfd3b2953885c34063547b736a4a1096fcb2
MD5 2c1fdeb2958c71f317b773dff0d397d0
SHA1 cc858f09f75e7e580e95cadefc7aa3f82bf230f8
SHA512 3409c66aa48b8c7a2640758dd7a0a971de676c4efe594d90fb9710788c2a2da6fa4e4d4fa681ea6375c254a64a7196eeaed85692ab461962f4d7bc239b6cca24
SSDEEP 12288:HNljwl+B0cDGUQyiRjsrhJPWEWU+HO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHl:HNlUO0MQdUhJPWEWU+HZlT+lQTD/O3Br
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5036	wfbxfkcvk.exe

Loads dropped DLL 1 IoCs

pid	Process
1336	wfbxfkcvk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wfbxfkcvk.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wfbxfkcvk.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wfbxfkcvk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 1336	5036	wfbxfkcvk.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1336	wfbxfkcvk.exe
1336	wfbxfkcvk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	wfbxfkcvk.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5036	wfbxfkcvk.exe
5036	wfbxfkcvk.exe
5036	wfbxfkcvk.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5036	wfbxfkcvk.exe
5036	wfbxfkcvk.exe
5036	wfbxfkcvk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 5036	816	Update_0129863793.exe	82
PID 816 wrote to memory of 5036	816	Update_0129863793.exe	82
PID 816 wrote to memory of 5036	816	Update_0129863793.exe	82
PID 5036 wrote to memory of 1336	5036	wfbxfkcvk.exe	83
PID 5036 wrote to memory of 1336	5036	wfbxfkcvk.exe	83
PID 5036 wrote to memory of 1336	5036	wfbxfkcvk.exe	83
PID 5036 wrote to memory of 1336	5036	wfbxfkcvk.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wfbxfkcvk.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wfbxfkcvk.exe

C:\Users\Admin\AppData\Local\Temp\Update_0129863793.exe
"C:\Users\Admin\AppData\Local\Temp\Update_0129863793.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\wfbxfkcvk.exe
  "C:\Users\Admin\AppData\Local\Temp\wfbxfkcvk.exe" "C:\Users\Admin\AppData\Local\Temp\snqkglrtgb.au3"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\wfbxfkcvk.exe
    "C:\Users\Admin\AppData\Local\Temp\wfbxfkcvk.exe" "C:\Users\Admin\AppData\Local\Temp\snqkglrtgb.au3"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

brapcjez.n

Path C:\Users\Admin\AppData\Local\Temp\brapcjez.n
Size 287KB
SHA256 e4d69dfa9ae660e93d5feb212828b0fc3d7e998168019ebe21781296423843cc
MD5 e79360f1b2961bf32e0db7f18cab3b67
SHA1 8858c34dcd5a70c438749600d10caef589c6121f
SHA512 6548f7d1eb812d76349704409a0bf8058d3133bd3dc159bc7738a1024add58198d624ecfec73629a3486453a1c8a05ee2ab0030d95c6df38eb32094021d29f0d
SSDEEP 6144:qtEF/rsxZ6QXA4TyUeQXYwQSmxaKDR0TIcWAif898Gq:qK9sDzNyUeQowQSmcKDR0TIckfz
MD5 SHA1 SHA512 SSDEEP

Submit Download

snqkglrtgb.au3

Path C:\Users\Admin\AppData\Local\Temp\snqkglrtgb.au3
Size 5KB
SHA256 634c99ca2d6402b912a232324617647ccf04bf6723fa238b19e387df2517a36c
MD5 d220b891040c5289933dc99240db2424
SHA1 7c416a4f65644df2ea1f78ae8708537521dda129
SHA512 0455d9bd8219d679a74d88b533a6e85434e61ebc4987760c675055527a18dc6538e1afbfc85de072f24dd5a0fa393ca47713fb4316950cbf912f8d5a8657178b
SSDEEP 48:/FWs6e2zV9mpcczh/MuLPC5/MiJ/MO/MD/MO/Mv/MO/M//MO/MCrL/MkOVpKL/M5:GHp0fCdQr0VpKsKpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfbxfkcvk.exe

Path C:\Users\Admin\AppData\Local\Temp\wfbxfkcvk.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfbxfkcvk.exe

Path C:\Users\Admin\AppData\Local\Temp\wfbxfkcvk.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjyuk.dj

Path C:\Users\Admin\AppData\Local\Temp\yjyuk.dj
Size 37KB
SHA256 abef61f4d8a8d7a569befe92062bcd05e0ea3c54f3d02e8fa73aeb9c637ff84b
MD5 34e614e3204b02a10909244b816d7a8d
SHA1 6a6e252e1c8ff02d45b4c195ddb1274b7c43867b
SHA512 ca2c4d9df75eb1c9ba18a3f145d23e516c2ebe6e21e7f614f15fa0c1fc62ee6baa310d5fd4dbf2731bb323f8d3add033530ae3e2fe84ebdb9bdb481b1ca54a24
SSDEEP 768:J5QncIHz44aMDsjTn6P8CGJdvFQRGh5cDFUtSpPRP:ziSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-139-0x00000000065D0000-0x0000000006B74000-memory.dmp

Download

memory/1336-140-0x0000000003180000-0x000000000321C000-memory.dmp

Download

memory/1336-141-0x0000000006520000-0x0000000006586000-memory.dmp

Download

memory/1336-142-0x0000000007C70000-0x0000000007CC0000-memory.dmp

Download

memory/1336-143-0x00000000086E0000-0x0000000008772000-memory.dmp

Download

memory/1336-144-0x0000000008650000-0x000000000865A000-memory.dmp

Download