ee4c7bdf3abd06150a2c2e6fe94bd41dc4157241c2a9cd4b6b0eb1842c70ee0b

General

Target
bbx0BqhoWryhUrV.exe
Size 3.0MB
Sample221020-gnkrhagehl
SHA256 ee4c7bdf3abd06150a2c2e6fe94bd41dc4157241c2a9cd4b6b0eb1842c70ee0b
MD5 af3504a8c3832ead7682686b8c0c602c
SHA1 3a57b35d4e05a68bcc66358974755c47c427cb30
SHA512 9e60b567045525e2c0bee9de5a415cb4e2526b2cf4b316697cdd1bc14ddadb7ca0d5e220b75320c05db04d5dcb3754ae020b9c62de526cbcea1ac727e23be1a7
SSDEEP 49152:V0fWUgzTHIy72PiEVfUXb3nvf4giqp7aL4fTEOcF1LSMyZFdj:V0frgzToywiExULnGZL4rEOoy5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
ambless@123

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bbx0BqhoWryhUrV.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bbx0BqhoWryhUrV.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bbx0BqhoWryhUrV.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 4068	2808	bbx0BqhoWryhUrV.exe	95

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	bbx0BqhoWryhUrV.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	bbx0BqhoWryhUrV.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2808	bbx0BqhoWryhUrV.exe
2808	bbx0BqhoWryhUrV.exe
2808	bbx0BqhoWryhUrV.exe
2808	bbx0BqhoWryhUrV.exe
2808	bbx0BqhoWryhUrV.exe
2808	bbx0BqhoWryhUrV.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	bbx0BqhoWryhUrV.exe
Token: SeDebugPrivilege	4068	bbx0BqhoWryhUrV.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2344	2808	bbx0BqhoWryhUrV.exe	92
PID 2808 wrote to memory of 2344	2808	bbx0BqhoWryhUrV.exe	92
PID 2808 wrote to memory of 2344	2808	bbx0BqhoWryhUrV.exe	92
PID 2808 wrote to memory of 5108	2808	bbx0BqhoWryhUrV.exe	93
PID 2808 wrote to memory of 5108	2808	bbx0BqhoWryhUrV.exe	93
PID 2808 wrote to memory of 5108	2808	bbx0BqhoWryhUrV.exe	93
PID 2808 wrote to memory of 3028	2808	bbx0BqhoWryhUrV.exe	94
PID 2808 wrote to memory of 3028	2808	bbx0BqhoWryhUrV.exe	94
PID 2808 wrote to memory of 3028	2808	bbx0BqhoWryhUrV.exe	94
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95
PID 2808 wrote to memory of 4068	2808	bbx0BqhoWryhUrV.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bbx0BqhoWryhUrV.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bbx0BqhoWryhUrV.exe

C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
"C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:3028
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bbx0BqhoWryhUrV.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bbx0BqhoWryhUrV.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/2808-135-0x00000000056F0000-0x00000000056FA000-memory.dmp

Download

memory/2808-132-0x0000000000A50000-0x0000000000D58000-memory.dmp

Download

memory/2808-136-0x0000000001550000-0x00000000015EC000-memory.dmp

Download

memory/2808-137-0x00000000015F0000-0x0000000001656000-memory.dmp

Download

memory/2808-134-0x0000000005760000-0x00000000057F2000-memory.dmp

Download

memory/2808-133-0x0000000005D10000-0x00000000062B4000-memory.dmp

Download

memory/4068-142-0x0000000000400000-0x0000000000626000-memory.dmp

Download

memory/4068-144-0x0000000007EE0000-0x0000000007EEA000-memory.dmp

Download

memory/4068-145-0x0000000007F10000-0x0000000007F22000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads