Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26/12/2022, 17:04
General
-
Target
6e893653c7423df0539e52768c35e717.exe
-
Size
1021KB
-
MD5
6e893653c7423df0539e52768c35e717
-
SHA1
8491cab5811f09638e146e1dc4526c0e9effca43
-
SHA256
6bcb3820bfc04a26be416d94d12312eac70f48dd6b354a3e9010606167198e5a
-
SHA512
496a2ccd996772c69cc8b28e9042f861df29109b47b26c166a52f59a4bece780c7efa5367618785672f378ae11fa6e8939cf0633bd17035c11284dce61bb16ba
-
SSDEEP
24576:TH0/iZ6LO8xC3k0IuHmzfXLunDAQOWIhafNnKDP2:D0/DvDruUigWi
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 62 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e893653c7423df0539e52768c35e717.exe"C:\Users\Admin\AppData\Local\Temp\6e893653c7423df0539e52768c35e717.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140203⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 5562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4424 -ip 44241⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\edit_r_exp_rhp..dll",lENRN0k=2⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD5d77a3c60f0b2518a9caaa80c97786310
SHA183704aca57927e36f6499d58a36314425648a196
SHA2561a9fb326adddff58559806c701604078e53da1ad15b25a09d19f3d8f216e6c7d
SHA51285942cfc7f08db98c851d13066a93a4c5fa0e883cacdd2d91c229978e78d6592e5fa3da164aea12e35a16c23d3ff78b4b395eec24402b68c35e9bc12fbe2c018
-
Filesize
792KB
MD5d77a3c60f0b2518a9caaa80c97786310
SHA183704aca57927e36f6499d58a36314425648a196
SHA2561a9fb326adddff58559806c701604078e53da1ad15b25a09d19f3d8f216e6c7d
SHA51285942cfc7f08db98c851d13066a93a4c5fa0e883cacdd2d91c229978e78d6592e5fa3da164aea12e35a16c23d3ff78b4b395eec24402b68c35e9bc12fbe2c018
-
Filesize
64KB
MD5efca15e60890fe74b53b0c415cf8fc68
SHA1f8d3d29a242101a144f9b6ea4923af3556f5774b
SHA256c4b27062149c30ffc466027919cc6881c6d25c00a8bcb8ec9bc0a570b8b3dab6
SHA5125d58a06f6d97d092c6b7811318a9182190d6ce397bb473ade6e8747592dccdd8e406dd7bc54591f670e004e1a55d7c6687222c5773172d6dadc5e82dfc18d128
-
Filesize
2KB
MD5db0acdbf49f80d3f3b0fb65a71b39341
SHA112c6d86ba5f90a1e1d2b4b4ec3bd94fc9f1296ae
SHA256f8a8635147117201638a6a4dfa8dcd5b4506cbee07f582001d2a92da434a231f
SHA5123d4e7547c8186164aa3fb7f08a50e6b065d536ca5ec8bc216c9dfd34c98e7c58c64ebcb39077fbd46370bc42b504acf769c6b3c7387cb98ec209087d4d46d784
-
Filesize
3.5MB
MD560a166514d47285f53fedcf3e3c4ba2b
SHA1e48c181980c3b32c7cf0cc3435ac5417d160414f
SHA25699216f40f93b9937d85f13880f67eec0183185b9d69ab4a7ebec9489fedfa3c1
SHA512040462478e24528053919c7e0d6548dc3fbff5c19826d10a7847d065aa8f49edcd965841aca5333e6ed7df0527d984483703e278b917b525efb0197ca0654de8
-
Filesize
1KB
MD56c2429d1fdb4a93ebca14340b9fb8fb7
SHA1e757fc9e129850598fff1931d496fb7c7b21d4d6
SHA25652b30a2b9d6a5c18dd585e3efe81688611b45f649e4e4e2c0543eaaf473f5285
SHA512bae2b99779cc2ec27a7fcf132ba66bb698c78b01048630fa22116fda906389be66458523efb9634976455b4063f3002ee781eabdf4abfb78ee295ae74927b228
-
Filesize
13KB
MD5c7405e2e68aec89e44862595ccc0d186
SHA12cc8d73f93dd875134917795633bb606911f1069
SHA2569a9adc35b9debbd0ded2aa1684769afd7fbb09b2e1afa20b19893de5fdbabe37
SHA5120cb3190812b404ff0cc32bc0442c8e0cc26ee989fbcab7284b21dbd134664f1b38fd3cb7e9a98898dd64b445ace1a117bd00cac793336fb25a819e17c60cab22
-
Filesize
820B
MD5a8664f5906d9060a0a87bc01e35179bb
SHA11bbbc9f10431d2941805907a8a6d4009f4e2938c
SHA256a8ed53b828f69fb5e6e28eef9a38b5753320aa7a942b4a4c2dbf67705d21e309
SHA512389a4be3833050f89ea0bc5327514b3d80753eb6a214d4ad58d8c1b22770dcca2cdf099d4563db98e3d3f9530474b147e49cbed4b5b3e3a9e315a797f056049f
-
Filesize
820B
MD509eb72768015735e81d549d7a5087631
SHA10dc0de9d9f1f94a73b760e13dbfb033d58b2962c
SHA256803200facef08eb731bceb63813c1c873628a271ada9661dda6bb4b638ccb5f8
SHA512240680b7e01215938623781f3431fb5ae8a2630590285a824f7e41e63e8e06f6fa79e641f4ace6d9dcb96f0c3fe3e928f5ac0eb2992158bda8cb83e95c7e916a
-
Filesize
855B
MD57ec956334fec33862a86ae1d3db724f5
SHA1009ef40b310d0068ec42c3ec85a424a147e9e712
SHA256c861b14bdbc003a3029af12487b4b01b9e3ece914afc6029b4cf59eb3156e3d7
SHA512ba478d4138c56b6a5e89a0daa58234a2c872e39684c946711b0fc972e63a91ab97bbb5e8300e03094e8fc243f8bf39e1931162bf95762142998428faf69c2af9
-
Filesize
12KB
MD52d995c7aa8d041ffa18821c898bc2cb7
SHA1f16ef806d79bffeec76f27102bd8e1273a0f3747
SHA256614e99dbea133397b0b4ee8a222df8502f8f782fbcdd44651793c1c894281948
SHA51281dcbfa24e216bf2a06379ca7d830bd6e16b58c16cd595704903a636f770eb70ca2146ec682559b48e9ff2518cbf3e1ed693050938a9a2b2e478eba6b86959e6
-
Filesize
192KB
MD54d0e5372be969ef8273a997c765f33aa
SHA106e9d80432b6a5c61cf81ca46d358ad5f01e45d6
SHA2563943fc4037e38355edb92fc186f3b7b8d56eceb7edddecf016a2c971e79cfa3c
SHA512457186c11c6b3affde2bab45b809e930b887c4d3e3e85fec1cf0390429b7f645cfef5b00d82bc2cf6507c21078f1f5ad688a6058724270262411f2a00eb68912
-
Filesize
64KB
MD55d72fc2d8115bba19c4044c03dad536c
SHA1c48301758485274df5a8406c0d91b20bf8b77c50
SHA256754da3b9dbaefc4c07e2b583fcf5a195aae663599bc3acdf6343b7c146248b87
SHA512301e0eeaade0dbeb0d2f26aa405593e53b3d4c688d535e0f07f80d87fa15cf8dc18e436bbfe21dfe819c1052a9ea2d89eed85dbbdbe896b3d8d314b0ffe052d8
-
Filesize
1KB
MD51d3eb6efb2054c0f8c6dfcc90af00e4e
SHA1452b9ea9cfbf42179a4e344e38ebad3a7179ead7
SHA2568fe6157bec03efbc921905d0df8f6f9f4432323f1244fc380ea404d5d0e2c95e
SHA512a0aefd1bf5bc0b275fbba3af7d06c672d82f3c7b40046f3f11515c6f3467f704d668985816f31f97a64e16c8c1112d78ea1f277e9001a3ef4d65df626544fcaf
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5d77a3c60f0b2518a9caaa80c97786310
SHA183704aca57927e36f6499d58a36314425648a196
SHA2561a9fb326adddff58559806c701604078e53da1ad15b25a09d19f3d8f216e6c7d
SHA51285942cfc7f08db98c851d13066a93a4c5fa0e883cacdd2d91c229978e78d6592e5fa3da164aea12e35a16c23d3ff78b4b395eec24402b68c35e9bc12fbe2c018
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.1MB
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
2.7MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB