785d95955d4b6874b8af4dcfc1b75bcad1029ff37aeea13525cfd9295f1a5ee9

General

Target

85c482b7adbacc9368a0bc9ba99da9f49037270c.exe
Size

446KB
MD5

18446141ac9b9a4b41763f8cf429318c
SHA1

85c482b7adbacc9368a0bc9ba99da9f49037270c
SHA256

785d95955d4b6874b8af4dcfc1b75bcad1029ff37aeea13525cfd9295f1a5ee9
SHA512

b9e35d1a26432593fb3e53865bbf3a378b7712a8082f200f2408a938162eb32546693762bd25b100957c811b4c3d2891c8a176b4b83674ad0ba8fe158245a26a
SSDEEP

12288:IYg1KH0frXRHMYTh1SSh9HVL7WwknPANzmRj:IYmzfrXRHvh1SSrZ7pkPAIN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3616	cqnawsegee.exe
4836	cqnawsegee.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cqnawsegee.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cqnawsegee.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cqnawsegee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3616 set thread context of 4836	3616	cqnawsegee.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3616	cqnawsegee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	cqnawsegee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3616	5076	85c482b7adbacc9368a0bc9ba99da9f49037270c.exe	82
PID 5076 wrote to memory of 3616	5076	85c482b7adbacc9368a0bc9ba99da9f49037270c.exe	82
PID 5076 wrote to memory of 3616	5076	85c482b7adbacc9368a0bc9ba99da9f49037270c.exe	82
PID 3616 wrote to memory of 4836	3616	cqnawsegee.exe	83
PID 3616 wrote to memory of 4836	3616	cqnawsegee.exe	83
PID 3616 wrote to memory of 4836	3616	cqnawsegee.exe	83
PID 3616 wrote to memory of 4836	3616	cqnawsegee.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cqnawsegee.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cqnawsegee.exe

C:\Users\Admin\AppData\Local\Temp\85c482b7adbacc9368a0bc9ba99da9f49037270c.exe
"C:\Users\Admin\AppData\Local\Temp\85c482b7adbacc9368a0bc9ba99da9f49037270c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe
  "C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe" C:\Users\Admin\AppData\Local\Temp\itxmwcot.e
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe
    "C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe

Filesize
52KB

MD5
84fd7094e873bdda344332401b76dfa9

SHA1
139ea7d22e38a9f4894f06dcb5286aa42de41297

SHA256
9e41cfc0982f5b467ce59e8fe10d40bdbbcafcf188bedeac1152cc976e7be755

SHA512
ef4eec540a54a54aa0e8ac3fba0e9d800d35b542389713b1651d80fc4ca541860c9bdaf9d2ace488f8ca4d542230cd57300f067240aa3bc4417a88f28be53342

Download Submit
C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe

Filesize
52KB

MD5
84fd7094e873bdda344332401b76dfa9

SHA1
139ea7d22e38a9f4894f06dcb5286aa42de41297

SHA256
9e41cfc0982f5b467ce59e8fe10d40bdbbcafcf188bedeac1152cc976e7be755

SHA512
ef4eec540a54a54aa0e8ac3fba0e9d800d35b542389713b1651d80fc4ca541860c9bdaf9d2ace488f8ca4d542230cd57300f067240aa3bc4417a88f28be53342

Download Submit
C:\Users\Admin\AppData\Local\Temp\cqnawsegee.exe

Filesize
52KB

MD5
84fd7094e873bdda344332401b76dfa9

SHA1
139ea7d22e38a9f4894f06dcb5286aa42de41297

SHA256
9e41cfc0982f5b467ce59e8fe10d40bdbbcafcf188bedeac1152cc976e7be755

SHA512
ef4eec540a54a54aa0e8ac3fba0e9d800d35b542389713b1651d80fc4ca541860c9bdaf9d2ace488f8ca4d542230cd57300f067240aa3bc4417a88f28be53342

Download Submit
C:\Users\Admin\AppData\Local\Temp\itxmwcot.e

Filesize
5KB

MD5
d76b921f43b520c661b186f258ea473e

SHA1
7bf21b08852657db42bf8dd577f03953644665ae

SHA256
5017f123d87ab38f034f6fbeb45f0a7f60ee19105bc060d23ba0972843eacfa9

SHA512
842a3381c898825c7036c171adc36f00cf2053fe9e88c7efb3767ad5d28c9d2c309c56520b6075f6a82cf79bff565026bf902aa8f6078c2e9bbde1b80a50820e

Download Submit
C:\Users\Admin\AppData\Local\Temp\poutiwma.y

Filesize
262KB

MD5
cf5b1fee67cf1a0c6c8ada94b4611718

SHA1
90fd4b76932356e3ba29781e1001f8ff550d7914

SHA256
24ffcd5159ea26f5aa0a761c5630c9b0f39b9a3d2ba55f7fd26c95034a19b926

SHA512
c4f825079bc3fb00c9d6d975fbd89b3eae71a010244954c2ea4b531aa43dca504cc3d0c2f4a79e9f0708b8feb9ba94eb25aef22ea3ae13daa34d30b688a9a13b

Download Submit
memory/3616-132-0x0000000000000000-mapping.dmp

Download
memory/4836-137-0x0000000000000000-mapping.dmp

Download
memory/4836-139-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/4836-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-141-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/4836-142-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/4836-143-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/4836-144-0x0000000005A40000-0x0000000005A90000-memory.dmp

Filesize
320KB

Download
memory/4836-145-0x0000000005C20000-0x0000000005DE2000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing