1e61114dd0413c14225fd80ca645f3826d73c06319c71f24c29757c1cefaa163

General

Target

79d637eda91c72961b25b64b7ce12a8328cc408b.exe
Size

448KB
MD5

c6c5fa8bfd81a3beb06fc36e71f86f37
SHA1

79d637eda91c72961b25b64b7ce12a8328cc408b
SHA256

1e61114dd0413c14225fd80ca645f3826d73c06319c71f24c29757c1cefaa163
SHA512

488c24160b77e2008bd9c29186f66a62c1ad0232489957843060dd8632e2a4379919d7931e8f30b01b6aca495756321eb8f0cbd3ecc33883480c2500c7cd6d38
SSDEEP

6144:OYa6zAE34VkTwN3tcYVljOqxpaYNGrtgbARYWscmlG8b5/mp4Zmv2QG:OYKE5+drljOqnayGBgbXcmlG8bm4wo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1036	mscxpq.exe
968	mscxpq.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mscxpq.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mscxpq.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mscxpq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 968	1036	mscxpq.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1036	mscxpq.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	mscxpq.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1036	3664	79d637eda91c72961b25b64b7ce12a8328cc408b.exe	81
PID 3664 wrote to memory of 1036	3664	79d637eda91c72961b25b64b7ce12a8328cc408b.exe	81
PID 3664 wrote to memory of 1036	3664	79d637eda91c72961b25b64b7ce12a8328cc408b.exe	81
PID 1036 wrote to memory of 968	1036	mscxpq.exe	82
PID 1036 wrote to memory of 968	1036	mscxpq.exe	82
PID 1036 wrote to memory of 968	1036	mscxpq.exe	82
PID 1036 wrote to memory of 968	1036	mscxpq.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mscxpq.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mscxpq.exe

C:\Users\Admin\AppData\Local\Temp\79d637eda91c72961b25b64b7ce12a8328cc408b.exe
"C:\Users\Admin\AppData\Local\Temp\79d637eda91c72961b25b64b7ce12a8328cc408b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\mscxpq.exe
  "C:\Users\Admin\AppData\Local\Temp\mscxpq.exe" C:\Users\Admin\AppData\Local\Temp\vhtheipb.hcu
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\mscxpq.exe
    "C:\Users\Admin\AppData\Local\Temp\mscxpq.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ajcdicbdd.nm

Filesize
262KB

MD5
62380db567a8a6f69f74c1721de13538

SHA1
2ce20713d22672de58cedede59faf6a40919bd6d

SHA256
e9fb52060cbfae9c892f88afe5108d1ab2386b7d40db9c28141fd278fe060d16

SHA512
c702bbbf9dc1a6c45ef79c3e4c14d728f3709feba1ca354a833f5339e1b0519a93bf571f6338c45b043be1e6807e9e19dc6057ee7e0b2f8e2717b45920eba7d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\mscxpq.exe

Filesize
48KB

MD5
c01d0fe2d758ddac74a889e2aa9409c3

SHA1
319b812df94f703404d3fa3205799e492b19ffa9

SHA256
5cc1698b7a4fc3036dc4e90a419b730aacd0595cc0a1ba0e10e583a23ca560bb

SHA512
89350b08a20175d64b170ad97cc5a5743835bfe8709db780621458bb6ecb6d6919350972203a44e7b18cc4d9082f4dc45ac685c361bbc33ec7070931262c1674

Download Submit
C:\Users\Admin\AppData\Local\Temp\mscxpq.exe

Filesize
48KB

MD5
c01d0fe2d758ddac74a889e2aa9409c3

SHA1
319b812df94f703404d3fa3205799e492b19ffa9

SHA256
5cc1698b7a4fc3036dc4e90a419b730aacd0595cc0a1ba0e10e583a23ca560bb

SHA512
89350b08a20175d64b170ad97cc5a5743835bfe8709db780621458bb6ecb6d6919350972203a44e7b18cc4d9082f4dc45ac685c361bbc33ec7070931262c1674

Download Submit
C:\Users\Admin\AppData\Local\Temp\mscxpq.exe

Filesize
48KB

MD5
c01d0fe2d758ddac74a889e2aa9409c3

SHA1
319b812df94f703404d3fa3205799e492b19ffa9

SHA256
5cc1698b7a4fc3036dc4e90a419b730aacd0595cc0a1ba0e10e583a23ca560bb

SHA512
89350b08a20175d64b170ad97cc5a5743835bfe8709db780621458bb6ecb6d6919350972203a44e7b18cc4d9082f4dc45ac685c361bbc33ec7070931262c1674

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtheipb.hcu

Filesize
6KB

MD5
214e77253f0f472f5cb0e63eb585b96f

SHA1
c3e90b4a248e0a1b43bc6e7c03c156729fb711a5

SHA256
ef33900a46b074e2ee759d7007ba12c18d7192bcbdc1c9ba8c4688a74e377a80

SHA512
682456d53d75526ef5b4b0c9aea5fe345368d4cb1c7f9c0a783d01d402d5bb2daa146d605dad8236348fe9257d373804d8268c19c166cba76847558c2738e23d

Download Submit
memory/968-139-0x0000000004AF0000-0x0000000005094000-memory.dmp

Filesize
5.6MB

Download
memory/968-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/968-141-0x00000000049D0000-0x0000000004A36000-memory.dmp

Filesize
408KB

Download
memory/968-142-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/968-143-0x0000000005A90000-0x0000000005A9A000-memory.dmp

Filesize
40KB

Download
memory/968-144-0x0000000005AF0000-0x0000000005B40000-memory.dmp

Filesize
320KB

Download
memory/968-145-0x0000000005BA0000-0x0000000005D62000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing