6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd

General

Target

6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe
Size

1.8MB
MD5

e813ff8d58b27f5a604b50052ab70c66
SHA1

154aeeeaeba842879e4e7e5d706d9766fd0d68e4
SHA256

6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd
SHA512

aed10d6cf8ca6ecf0315a272db3d95532e1000ff1c2436deb70e307f115fcf0fcbcfaa17fc8101d417b45c6c2922827c3049ced685e21262c59a153fb84e2170
SSDEEP

49152:o31v2tsNsAhbn/sP/AQN3DhuDSoDTAKmmpVR:41vasNnnUPV37KAK/nR

Score

8^/10

collection persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

tmp373B.tmp.exe

pid process

1248 tmp373B.tmp.exe

pid	process
1248	tmp373B.tmp.exe

Loads dropped DLL 2 IoCs

Processes:

6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe

pid	process
1364	6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe
1364	6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

OUTLOOK.EXEtmp373B.tmp.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	tmp373B.tmp.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tmp373B.tmp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	tmp373B.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Defender = "\"C:\\ProgramData\\adminProcesso.exe\""	tmp373B.tmp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	tmp373B.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Defender = "\"C:\\ProgramData\\adminProcesso.exe\""	tmp373B.tmp.exe

Drops file in System32 directory 14 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

OUTLOOK.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

OUTLOOK.EXE

pid process

1744 OUTLOOK.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

tmp373B.tmp.exe

pid process

1248 tmp373B.tmp.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

tmp373B.tmp.exeOUTLOOK.EXE

pid process

1248 tmp373B.tmp.exe
1744 OUTLOOK.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

OUTLOOK.EXE

pid process

1744 OUTLOOK.EXE
1744 OUTLOOK.EXE
1744 OUTLOOK.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

OUTLOOK.EXE

pid process

1744 OUTLOOK.EXE
1744 OUTLOOK.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OUTLOOK.EXE

pid process

1744 OUTLOOK.EXE

pid	process
1744	OUTLOOK.EXE

pid	process
1248	tmp373B.tmp.exe

pid	process
1248	tmp373B.tmp.exe
1744	OUTLOOK.EXE

pid	process
1744	OUTLOOK.EXE
1744	OUTLOOK.EXE
1744	OUTLOOK.EXE

pid	process
1744	OUTLOOK.EXE
1744	OUTLOOK.EXE

pid	process
1744	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe

description	pid	process	target process
PID 1364 wrote to memory of 1248	1364	6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe	tmp373B.tmp.exe
PID 1364 wrote to memory of 1248	1364	6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe	tmp373B.tmp.exe
PID 1364 wrote to memory of 1248	1364	6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe	tmp373B.tmp.exe
PID 1364 wrote to memory of 1248	1364	6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe	tmp373B.tmp.exe

outlook_win_path 1 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE

C:\Users\Admin\AppData\Local\Temp\6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe
"C:\Users\Admin\AppData\Local\Temp\6626cd67f01274254abfb1a9be9f0c186297914213cbb566250312dfc31d80bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\tmp373B.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp373B.tmp.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1248

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp373B.tmp.exe
Filesize
2.5MB

MD5
734136403cb49a4b044741e624b59f56

SHA1
c49bbe906ae40f65c5e11ae19d9e0b6370e7c92a

SHA256
4abcf2c542779046822c303ad42b7151008484eebf6aef4ce94d226e70a7be71

SHA512
2ef8e202007fde3acc587ee7271d3655646b8428ae19411d4973e8c9434b0cbc5eb3ee15ef50ef9b3f8abd83fdfe53e3f6e7398746b9ff51b1f66d906ab5e2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp373B.tmp.exe
Filesize
2.5MB

MD5
734136403cb49a4b044741e624b59f56

SHA1
c49bbe906ae40f65c5e11ae19d9e0b6370e7c92a

SHA256
4abcf2c542779046822c303ad42b7151008484eebf6aef4ce94d226e70a7be71

SHA512
2ef8e202007fde3acc587ee7271d3655646b8428ae19411d4973e8c9434b0cbc5eb3ee15ef50ef9b3f8abd83fdfe53e3f6e7398746b9ff51b1f66d906ab5e2ef

Download Submit
\Users\Admin\AppData\Local\Temp\tmp373B.tmp.exe
Filesize
2.5MB

MD5
734136403cb49a4b044741e624b59f56

SHA1
c49bbe906ae40f65c5e11ae19d9e0b6370e7c92a

SHA256
4abcf2c542779046822c303ad42b7151008484eebf6aef4ce94d226e70a7be71

SHA512
2ef8e202007fde3acc587ee7271d3655646b8428ae19411d4973e8c9434b0cbc5eb3ee15ef50ef9b3f8abd83fdfe53e3f6e7398746b9ff51b1f66d906ab5e2ef

Download Submit
\Users\Admin\AppData\Local\Temp\tmp373B.tmp.exe
Filesize
2.5MB

MD5
734136403cb49a4b044741e624b59f56

SHA1
c49bbe906ae40f65c5e11ae19d9e0b6370e7c92a

SHA256
4abcf2c542779046822c303ad42b7151008484eebf6aef4ce94d226e70a7be71

SHA512
2ef8e202007fde3acc587ee7271d3655646b8428ae19411d4973e8c9434b0cbc5eb3ee15ef50ef9b3f8abd83fdfe53e3f6e7398746b9ff51b1f66d906ab5e2ef

Download Submit
memory/1248-58-0x0000000000000000-mapping.dmp

Download
memory/1364-61-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-55-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-63-0x00000000727F1000-0x00000000727F3000-memory.dmp

Filesize
8KB

Download
memory/1744-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1744-66-0x00000000737DD000-0x00000000737E8000-memory.dmp

Filesize
44KB

Download
memory/1744-67-0x000000006D291000-0x000000006D293000-memory.dmp

Filesize
8KB

Download
memory/1744-68-0x000000006CA51000-0x000000006CA53000-memory.dmp

Filesize
8KB

Download
memory/1744-69-0x00000000737DD000-0x00000000737E8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads