Analysis
-
max time kernel
91s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 00:45
Static task
static1
Behavioral task
behavioral1
Sample
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe
Resource
win10v2004-20220812-en
General
-
Target
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe
-
Size
2.4MB
-
MD5
7a7d28dbde9e170bdd4661fa62a836b5
-
SHA1
2df73fbd586638c889e7f309fbe391bffe517d55
-
SHA256
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3
-
SHA512
fec2e7596cab5c1ff880abc0019e9e6a523ce6c3c211a58770ecc080d8ed0219e092d7e18948a9c5cbe546425a55b647bcdf4cc04510bc65e7f72bb6fef1df58
-
SSDEEP
49152:LVg5tQ7aQis5YzaOsPjswugZCaoUizAYvHCVwvXL:Bg566zzsLAgZCa5+V1v7
Malware Config
Signatures
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exedescription pid process target process PID 4284 set thread context of 3644 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe PID 3644 set thread context of 3056 3644 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe iexplore.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exepid process 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exepid process 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exedescription pid process target process PID 4284 wrote to memory of 3644 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe PID 4284 wrote to memory of 3644 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe PID 4284 wrote to memory of 3644 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe PID 4284 wrote to memory of 3644 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe PID 4284 wrote to memory of 3644 4284 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe PID 3644 wrote to memory of 3056 3644 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe iexplore.exe PID 3644 wrote to memory of 3056 3644 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe iexplore.exe PID 3644 wrote to memory of 3056 3644 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe iexplore.exe PID 3644 wrote to memory of 3056 3644 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe iexplore.exe PID 3644 wrote to memory of 3056 3644 9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe"C:\Users\Admin\AppData\Local\Temp\9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe"C:\Users\Admin\AppData\Local\Temp\9df38a21e7d55cdcbb39e79f4e09d0a9e62ff89a31166fcd39dd2b07ad0c97a3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" /stext C:\sys.pni3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3644-132-0x0000000000000000-mapping.dmp
-
memory/3644-133-0x0000000001630000-0x00000000017A6000-memory.dmpFilesize
1.5MB
-
memory/3644-134-0x0000000001630000-0x00000000017A6000-memory.dmpFilesize
1.5MB
-
memory/3644-135-0x0000000001630000-0x00000000017A6000-memory.dmpFilesize
1.5MB
-
memory/3644-136-0x0000000001630000-0x00000000017A6000-memory.dmpFilesize
1.5MB
-
memory/3644-137-0x0000000001630000-0x00000000017A6000-memory.dmpFilesize
1.5MB