Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26/12/2022, 22:13
General
-
Target
2b28b1b6f180b4b0945bbcc20ee2359a755d724a9dbdd6bd6fe3757e3c39c94b.exe
-
Size
1018KB
-
MD5
328c8b96d14f7d8fb30b241b050bc791
-
SHA1
f82d16266545f6c832e8de648d4a805db76cd0f0
-
SHA256
2b28b1b6f180b4b0945bbcc20ee2359a755d724a9dbdd6bd6fe3757e3c39c94b
-
SHA512
d339ed6143a78a765a40d2bb509414c22040ed05821afac57d1ec75eca0277e892cd83162ac1c848ffddb55ffdcbd94ef4eef4cbe237967b94321df7a3cd2ae7
-
SSDEEP
24576:BA1aqFK3oGDLpbHDGIP/W5BSG+TG30RXj6QjTI:BUaDZKz8GAz
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 61 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b28b1b6f180b4b0945bbcc20ee2359a755d724a9dbdd6bd6fe3757e3c39c94b.exe"C:\Users\Admin\AppData\Local\Temp\2b28b1b6f180b4b0945bbcc20ee2359a755d724a9dbdd6bd6fe3757e3c39c94b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140263⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4632 -ip 46321⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\acrolayoutrecognizer.dll",dD42Vg==2⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD5d5fdbe09b699e7de6623546171db96c7
SHA1be0e24fccf7f78bb07e3b7c9f29cc129b0123f4f
SHA256179e2342f89c09a0e626e74bfb5be012ec756446310a0493c5843ae03a26ca8f
SHA51212887a0fa40f84227e6fef0eb9733881d93698b37518651af504ee3c584b1c94f4133aaa742b304e2f7d4fbe46a4be62fdee83aaa06f48289249e33857cac9de
-
Filesize
792KB
MD5d5fdbe09b699e7de6623546171db96c7
SHA1be0e24fccf7f78bb07e3b7c9f29cc129b0123f4f
SHA256179e2342f89c09a0e626e74bfb5be012ec756446310a0493c5843ae03a26ca8f
SHA51212887a0fa40f84227e6fef0eb9733881d93698b37518651af504ee3c584b1c94f4133aaa742b304e2f7d4fbe46a4be62fdee83aaa06f48289249e33857cac9de
-
Filesize
158B
MD5dd8778eda0b96d5d71716fbb50300293
SHA117b3a49fe039ef5c930801c3a77922b30a61ee69
SHA25661e06f4deff92e80d1605cb17a0c83604ac6cdb72fb3d4b1e3d0eb7e7bbbf4a0
SHA5124efee799ddfb3d98a6b402aebed2ec79cfbd1cab200bfad1f95af432b91ce11e0404cd1cdf9f5a46324757c135928cb0ce42197c3021ae506ac6dd047127491b
-
Filesize
30KB
MD598de295b21abe2451f86b82df3be269a
SHA11665a23d307748e8c1c0164ba7939275f9fb676c
SHA256fd3507cd60edf41093c8fe843d1601e33db9cbe1cd36247cec587c265109bcfa
SHA512230ae283c81771496dcae9ef84787379712106738ea82754b101af9047ae27cadb8b1f4aed00d146a699c22fd1c505c31068418a70d2b535c85c3017726d91cc
-
Filesize
3.5MB
MD529339534aae48a83c83c1d43a18125ab
SHA140d5bef1e1bdd0c854e50dd5aead3b850a79c32d
SHA256dc77d9bcdfb4ecfd5038b56d71b480bf8b4a90a8f8fe0477e169fcab33b83d0d
SHA512613e9072a87188cb4bf1faaf385c7e998154c4a846fc1949f3a0507e7e0e8a9c13b42744eeb58a246943ca5809ac5dddd55ee2e3dc3bda974cfa51d25a072cbf
-
Filesize
3.5MB
MD529339534aae48a83c83c1d43a18125ab
SHA140d5bef1e1bdd0c854e50dd5aead3b850a79c32d
SHA256dc77d9bcdfb4ecfd5038b56d71b480bf8b4a90a8f8fe0477e169fcab33b83d0d
SHA512613e9072a87188cb4bf1faaf385c7e998154c4a846fc1949f3a0507e7e0e8a9c13b42744eeb58a246943ca5809ac5dddd55ee2e3dc3bda974cfa51d25a072cbf
-
Filesize
830B
MD505cd2b53b1d4a6dfec2c8e5bea828b91
SHA1717e71c2e42f0a993d6a110c3b6c37e5560837ec
SHA256225e46e9c3381e4935dc7c245ce3e3fec92d1a777b2af82c3aae05802d7420c7
SHA512a6d69ed210136c098d7ead5b22d2317476fa1ad1690b52f9b1c3620d7b0e52a5adc4f90e18cf971af48bab3a9d8afd50d0d4536ab73faa288687bedc11a5d1e2
-
Filesize
2KB
MD52ff808c347a1bd28f3df3bc8873d73d6
SHA1afc3b29446a1e5ea641db1c5f1521b2f5c814581
SHA2566d6bb6749a28b69f42fede441d1c84dbff9c3f69938e637eee4fc260d0c92301
SHA51233c2861f5b1f0b87be1f7a5d59313d5977d284ba70a126541f2daed6297ac35cf11c4f43107148f05da7e4748f49b3e99335d4c2164ba04e0a4f17830afd1706
-
Filesize
829B
MD587abe99363b16041e32b8a146eb53617
SHA1b1f3f3c3939f2331dee213e480f4a4d0c753f72a
SHA2567c8df7b34fca6387a15cbc0d6f591624a5a28bf513f71eb1077d55f1b448d856
SHA512091ffae18e7cf41237b1039964cb4c3116275edfa34b198bbb9a0b258a99bf3b62b420fb22d747788a889f2306c30f0dc00566c432d4b2bb2e410a9e7dc69e44
-
Filesize
15KB
MD5c73eeb9dedd94a612969e003260e6341
SHA10451277183bad12e3179c12c0a14694fab52bc8d
SHA2561ee54a9294af6727770aff79f2c901cd40ca23dfb4803788042aada54146e355
SHA512d78542d9c74efeac1d925d9d05c691c5543d04e6b671a5ef160f0fafc3b4444d327cf37206d78f43b607f817b6545cb9673b85d713b8c59d0c97103aee55245a
-
Filesize
84KB
MD5ace207b26c7eec1093af025cc57755ab
SHA196cd00ca09b272c1f67ffa692debf5d18ac157e9
SHA256de7e015ecee7971276a15756c66935502aa9362d964926928a7b58db2590bf5e
SHA512070f047857ac03f34bf9b1c60f7a0a3f300ec0aad76d0b52f55aaac5704110fc82af512547fcbc4750cb7bc09cad681f7db26639c853969058d34f696122ceff
-
Filesize
3KB
MD5a186bfcab0d099811bf38b4c09102755
SHA19aadb653c69a0009f39d187a76ba51c0869ff9f2
SHA25688b885c0292640fbbde80bbe0764b23e4d9621b89b9077056c0e12bc2deb7e2f
SHA512c0e7cc96ee60aa8abe6e9ddbb3eef76561ff332f32fcc1acc950fcd4a03e958eab40590bb5e6912771950c8110838831f265199b040934e1aa3e5224bd33443f
-
Filesize
13KB
MD591452b27335b69acc128a8a841bfe405
SHA17d63c758a2d4d16ef4175637ed17d5ad2080a329
SHA256ce07da21a959291739ec76f403576ef995d1bb29826b490184c2fe6a4e5c7b10
SHA512ba5ff3e4e596e685ec3dff0951c298c76fd2240f774d0d01b80bce6ad5e234a208d0f775c0d2b30d0b9dfefb3e8bce173db4b1e77a9ca16251dde662a005163b
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5d5fdbe09b699e7de6623546171db96c7
SHA1be0e24fccf7f78bb07e3b7c9f29cc129b0123f4f
SHA256179e2342f89c09a0e626e74bfb5be012ec756446310a0493c5843ae03a26ca8f
SHA51212887a0fa40f84227e6fef0eb9733881d93698b37518651af504ee3c584b1c94f4133aaa742b304e2f7d4fbe46a4be62fdee83aaa06f48289249e33857cac9de
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
2.7MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
856KB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB