Analysis
-
max time kernel
41s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11-01-2023 13:20
General
-
Target
029244265332645d1676e3dd2ea21b7f4cd2e758.exe
-
Size
166KB
-
MD5
af1ec52c6fefb19f95bd1712154f664a
-
SHA1
029244265332645d1676e3dd2ea21b7f4cd2e758
-
SHA256
5c46c800ec8a689b837f7c808b4a9bd81079b7aca9106d1a9cc45bfe2cae2db5
-
SHA512
15a0c9fcabd1dd8a6d54186e79a2533b7fe24ff45403e0de151959883d46cdb95c7ee0143389dca0042a651e1c1675a0e19a91ef4c69b9c188867093a1b041f7
-
SSDEEP
3072:lzw73WbvkHbF1304gDSk8rixjNvPtJyAKu6B6yjv:9wGMHQLMU3PbEV
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\029244265332645d1676e3dd2ea21b7f4cd2e758.exe"C:\Users\Admin\AppData\Local\Temp\029244265332645d1676e3dd2ea21b7f4cd2e758.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
8KB