acceb3aeb37b9afbd421dfe6e5e1d1b0c2da5140570be64dc4964a6ae72f9cba

General

Target

0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe
Size

1.4MB
MD5

d5c62976692227d14eaf77a9c94f33eb
SHA1

79f483945c14981d98b9ed439649a636da7d5fc5
SHA256

0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55
SHA512

d8e24bd9fe65f88296359a4c7f52240ec5dd475c9ad922d8a476bd6d3a2ff021b84b4050eccc0e9366ac8756bdd8a09986a65de37833960a84dbc27d49a8c93c
SSDEEP

24576:fSKJvsK31YXRzTACANlGm79cDA9dQWuc4gwRrD/+mvHT9+TmqinR:fS6pFVlGU9kWuRJD/3vHTamZR

Score

8^/10

collection discovery spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 712 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

712 rundll32.exe
712 rundll32.exe
712 rundll32.exe
712 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
3	712	rundll32.exe

pid	process
712	rundll32.exe
712	rundll32.exe
712	rundll32.exe
712	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

712 rundll32.exe
712 rundll32.exe

pid	process
712	rundll32.exe
712	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe

description	pid	process	target process
PID 1232 wrote to memory of 712	1232	0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe	rundll32.exe
PID 1232 wrote to memory of 712	1232	0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe	rundll32.exe
PID 1232 wrote to memory of 712	1232	0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe	rundll32.exe
PID 1232 wrote to memory of 712	1232	0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe	rundll32.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe
"C:\Users\Admin\AppData\Local\Temp\0e811acb3a0e94be6836e399386990a40515a686c5f536da764a6ed350403a55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\nsis_uns6d9454.dll",PrintUIEntry |5CQkOhiAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAOVkHwBs8|AtBVEAefsATB8AOAB3AHb|AFAATwBKAGfrAFUfAFktAllIg||sKOgEAgAASP+DxCjDzMzMTP+JRCQYSIlUJL8QSIlMJAhZAUj|i0QkMEiJBCT2fQE4SGsACEjHRNskEC0B6w59ARBI14PAAYsBEH0BQEjtOZIAcyWbA4sMJP9IA8hIi8FIi|VMpwFUdwAD0UiLf8qKCYgI68FiBb9lSIsEJWDz8DP|yUiLUBhIO9H|dDZIg8IgSIv|Akg7wnQqZoP|eEgYdRpMi0D|UGZBgzhrdAfuDRFLdQgNEHgQLv90BUiLAOvVSOuLSPkAwWYAQFNV|1ZXQVRBVUFW+0FXWQFmgTlNWv9Ni|hMi|JIi+|ZD4X88|BMY0n|PEGBPAlQRQDvAA+F6vPwQYuE+wmI8|CFwEiNPO8BD4TWZhGDvAndjC0BD4TH8|BEi|9nIESLXxyLd|8kRItPGEwD4f9MA9lIA|Ezyb9FhckPhKTz8E3|i8RBixBFM9L|SAPTigKEwHT|HUHByg0PvsDe9gABRAPQuxF17P9Bgfqq|A18dP8Og8EBSYPABP9BO8lzaevGi||BD7cMTkWLLP+LTAPrdFgz7b6mEHRRQYsUvQDT|zPJigJMi8Lrtw|BycQRA8jhEAH3QYoA0RDtM8Azn|ZBOwy23BCiAIP|xgGD+Ahy7uv|CkiLy0H|1UnfiQT3g8XgEMQE3ztvGHKvYgFBX|9BXkFdQVxfXvtdWy8XSIHsYAH+YACL6ehm|v||v0iFwA+EmXEgTPWNqwGLJxDIM||o|Zt5II1fBEyNRf9CM9KLy|9UJP1ofCBMi+APhGx6cSBFpBAzwIvTjSBfSIl8JCCiIHB8ID9Ii|APhExxIKIg|1BIjVYIRI1H30BIjYwkgRFIi+|Y6Hz9eiCNVkhq2iAQ3iHM8|DoZ+sgP0SLBo1XCD0goiC9WMYhiYQkgIMS3fbz8IsO1iBYiYwk2G0RAzCNIOgx6yBMi+9dOousKTJIi5z+FjJMiWQkOESNv2dsSTvsSIYgMHdMiVyAAYQk3IMR04aO4yHfIPCsE0iLb9Po5|wBMIqcczL3SI2EczJBgPMhv0mLzEQwGKACg7|pAXXzgbxzMiH|UmV4dUqLhCTd9B4xlCT48|ADwv9IO+hyNUE71P92MESNSUBJK0|UQbgAlACiIEDGIs|4dBdEtDC+MUiN+1NsjSBNK8TobO6AMEiLzqIgeEiFz|90FEyMMBcxSI3fTCRAugPz8P|XZ0iBxHAhXSQAAA==
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\nsis_uns6d9454.dll

Filesize
58KB

MD5
664e46926466a2d4c9b87540f4853c39

SHA1
b172d1c2bde331770b0a944fcf6a9e2d75ded66b

SHA256
92a7c3296a561fb39798f821173e69d1feff44ff3a84caa4c6bb890945e79488

SHA512
1490ee65220c71a9f445df4b0f34d0c7bd3ece2e58253cfa3194d34e813843e0f71ea7bce0f0ae562a620334fdf3589262ca2f3209414936aa28a365db64ff03

Download Submit
\Users\Admin\AppData\Roaming\nsis_uns6d9454.dll

Filesize
58KB

MD5
664e46926466a2d4c9b87540f4853c39

SHA1
b172d1c2bde331770b0a944fcf6a9e2d75ded66b

SHA256
92a7c3296a561fb39798f821173e69d1feff44ff3a84caa4c6bb890945e79488

SHA512
1490ee65220c71a9f445df4b0f34d0c7bd3ece2e58253cfa3194d34e813843e0f71ea7bce0f0ae562a620334fdf3589262ca2f3209414936aa28a365db64ff03

Download Submit
\Users\Admin\AppData\Roaming\nsis_uns6d9454.dll

Filesize
58KB

MD5
664e46926466a2d4c9b87540f4853c39

SHA1
b172d1c2bde331770b0a944fcf6a9e2d75ded66b

SHA256
92a7c3296a561fb39798f821173e69d1feff44ff3a84caa4c6bb890945e79488

SHA512
1490ee65220c71a9f445df4b0f34d0c7bd3ece2e58253cfa3194d34e813843e0f71ea7bce0f0ae562a620334fdf3589262ca2f3209414936aa28a365db64ff03

Download Submit
\Users\Admin\AppData\Roaming\nsis_uns6d9454.dll

Filesize
58KB

MD5
664e46926466a2d4c9b87540f4853c39

SHA1
b172d1c2bde331770b0a944fcf6a9e2d75ded66b

SHA256
92a7c3296a561fb39798f821173e69d1feff44ff3a84caa4c6bb890945e79488

SHA512
1490ee65220c71a9f445df4b0f34d0c7bd3ece2e58253cfa3194d34e813843e0f71ea7bce0f0ae562a620334fdf3589262ca2f3209414936aa28a365db64ff03

Download Submit
\Users\Admin\AppData\Roaming\nsis_uns6d9454.dll

Filesize
58KB

MD5
664e46926466a2d4c9b87540f4853c39

SHA1
b172d1c2bde331770b0a944fcf6a9e2d75ded66b

SHA256
92a7c3296a561fb39798f821173e69d1feff44ff3a84caa4c6bb890945e79488

SHA512
1490ee65220c71a9f445df4b0f34d0c7bd3ece2e58253cfa3194d34e813843e0f71ea7bce0f0ae562a620334fdf3589262ca2f3209414936aa28a365db64ff03

Download Submit
memory/712-69-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/712-68-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download
memory/712-74-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/712-62-0x0000000000000000-mapping.dmp

Download
memory/712-73-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/712-70-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download
memory/1232-56-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/1232-60-0x0000000000282000-0x0000000000284000-memory.dmp

Filesize
8KB

Download
memory/1232-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1232-57-0x0000000000282000-0x0000000000284000-memory.dmp

Filesize
8KB

Download
memory/1232-54-0x00000000005B0000-0x00000000005E2000-memory.dmp

Filesize
200KB

Download
memory/1232-58-0x0000000001FC0000-0x0000000001FDD000-memory.dmp

Filesize
116KB

Download
memory/1232-71-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/1232-72-0x0000000001FC0000-0x0000000001FDD000-memory.dmp

Filesize
116KB

Download
memory/1232-59-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/1232-61-0x0000000001FC0000-0x0000000001FDD000-memory.dmp

Filesize
116KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads