6688763571e1e1b2bf8e0aa07e10fde2c6c7882aa62d43b2fe049b539e2b8044

Analysis

max time kernel
42s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/01/2023, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
802b89e1cdf76e51b9f082a05c3eaf34.exe
Size 663KB
Sample230126-ppgegade77
SHA256 6688763571e1e1b2bf8e0aa07e10fde2c6c7882aa62d43b2fe049b539e2b8044
MD5 802b89e1cdf76e51b9f082a05c3eaf34
SHA1 5f5cf918964840a9c22c3f5fab1cc7403573bc1b
SHA512 c2d4e7e9a48a3ef7c32f95b467f5bfb66edc0e2f23ad0d62714f647f34d9d831d6816e5f35a51956ab00b1157d61d842b5b15ffeedee82dcc6d86a36a741d48b
SSDEEP 6144:WYa6mUeUcyeecOwMZGcFMvYDrGOvInXX4yxhmScgXR7bW:WY/5ebzRcFB5vf2cgXR7bW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1432	ftnwwckf.exe
1064	ftnwwckf.exe

Loads dropped DLL 3 IoCs

pid	Process
1132	802b89e1cdf76e51b9f082a05c3eaf34.exe
1132	802b89e1cdf76e51b9f082a05c3eaf34.exe
1432	ftnwwckf.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftnwwckf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftnwwckf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftnwwckf.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 1064	1432	ftnwwckf.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1432	ftnwwckf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	ftnwwckf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1064	ftnwwckf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1432	1132	802b89e1cdf76e51b9f082a05c3eaf34.exe	28
PID 1132 wrote to memory of 1432	1132	802b89e1cdf76e51b9f082a05c3eaf34.exe	28
PID 1132 wrote to memory of 1432	1132	802b89e1cdf76e51b9f082a05c3eaf34.exe	28
PID 1132 wrote to memory of 1432	1132	802b89e1cdf76e51b9f082a05c3eaf34.exe	28
PID 1432 wrote to memory of 1064	1432	ftnwwckf.exe	29
PID 1432 wrote to memory of 1064	1432	ftnwwckf.exe	29
PID 1432 wrote to memory of 1064	1432	ftnwwckf.exe	29
PID 1432 wrote to memory of 1064	1432	ftnwwckf.exe	29
PID 1432 wrote to memory of 1064	1432	ftnwwckf.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftnwwckf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ftnwwckf.exe

C:\Users\Admin\AppData\Local\Temp\802b89e1cdf76e51b9f082a05c3eaf34.exe
"C:\Users\Admin\AppData\Local\Temp\802b89e1cdf76e51b9f082a05c3eaf34.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe
  "C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe" C:\Users\Admin\AppData\Local\Temp\ftiylmys.xp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe
    "C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cocelg.i

Path C:\Users\Admin\AppData\Local\Temp\cocelg.i
Size 262KB
SHA256 8edb3caf034fb9fe983aaafbc93c699b9975fc73fd26dd57fd5fe6449ac0c286
MD5 b36a188553b238d59ce87fd0698ecee9
SHA1 ebe984155c9a7e146d9c61dd2d6d399a81e9e0f4
SHA512 07164748d8648b705ac90b02a8d2d7a95d44224b681412ccbf017adbe4208805b0fea21b1cb23259abe212a4f5f252e39f1f84b388b9a9ac2ae58657784cad8d
SSDEEP 6144:fHsMIE7HVbv51pW63nnolGl+MGnijg6XxKjxdaZeK8XeIlD:fHsMtZ3L+Mjd8jxBtx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftiylmys.xp

Path C:\Users\Admin\AppData\Local\Temp\ftiylmys.xp
Size 5KB
SHA256 72ade0d3264e295fc506f904c6056c41754c3f9e2f1f056ed2784566b531ac9d
MD5 f0c0a6d889bb9f360d2d430572563c36
SHA1 544ac77adcce98de4926d68d365acaef191649d3
SHA512 b9031a41c88990182fbac2ad485c26b8bf126fc797a76f69793e57c6e63e30d2f470d44caafc8078ed76526952afe49ef4f3e544b953689807302457faf0d3b9
SSDEEP 96:Farc6oYEg/DrYulk2XO5oSwIx+/9IOQFlVEMAFqce1HqJVyDIR5u3Rummi8w5d8G:FarcR4dhX1SNxfOQFbbAgcelqJV3R5Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftnwwckf.exe

Path C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe
Size 81KB
SHA256 6693e7c922c3f1976d4f6583d664a8cb992d5202521a77da5cd0be60b85829f5
MD5 fe48ec1fee1dde216ee4b92d64bae4f3
SHA1 797569015b8a844b516588383b393fd713afc74f
SHA512 b79ffb634ed0b5dc4c193ffabf2749facef47134838c1fc75542ca91127c6423d8e371ba590ad6202dd8715ea005ccdcd3377c0edf8b889cc1cd9d56ef6b6b12
SSDEEP 1536:9+AJHMGR4DGjFpK5sFtNTphbr1Rw4Ilp+rUmqpQ1VGHDubmfs71:DHMGR4oX9tNTphbr1Rkp+r9r2SF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftnwwckf.exe

Path C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe
Size 81KB
SHA256 6693e7c922c3f1976d4f6583d664a8cb992d5202521a77da5cd0be60b85829f5
MD5 fe48ec1fee1dde216ee4b92d64bae4f3
SHA1 797569015b8a844b516588383b393fd713afc74f
SHA512 b79ffb634ed0b5dc4c193ffabf2749facef47134838c1fc75542ca91127c6423d8e371ba590ad6202dd8715ea005ccdcd3377c0edf8b889cc1cd9d56ef6b6b12
SSDEEP 1536:9+AJHMGR4DGjFpK5sFtNTphbr1Rw4Ilp+rUmqpQ1VGHDubmfs71:DHMGR4oX9tNTphbr1Rkp+r9r2SF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftnwwckf.exe

Path C:\Users\Admin\AppData\Local\Temp\ftnwwckf.exe
Size 81KB
SHA256 6693e7c922c3f1976d4f6583d664a8cb992d5202521a77da5cd0be60b85829f5
MD5 fe48ec1fee1dde216ee4b92d64bae4f3
SHA1 797569015b8a844b516588383b393fd713afc74f
SHA512 b79ffb634ed0b5dc4c193ffabf2749facef47134838c1fc75542ca91127c6423d8e371ba590ad6202dd8715ea005ccdcd3377c0edf8b889cc1cd9d56ef6b6b12
SSDEEP 1536:9+AJHMGR4DGjFpK5sFtNTphbr1Rw4Ilp+rUmqpQ1VGHDubmfs71:DHMGR4oX9tNTphbr1Rkp+r9r2SF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftnwwckf.exe

Path \Users\Admin\AppData\Local\Temp\ftnwwckf.exe
Size 81KB
SHA256 6693e7c922c3f1976d4f6583d664a8cb992d5202521a77da5cd0be60b85829f5
MD5 fe48ec1fee1dde216ee4b92d64bae4f3
SHA1 797569015b8a844b516588383b393fd713afc74f
SHA512 b79ffb634ed0b5dc4c193ffabf2749facef47134838c1fc75542ca91127c6423d8e371ba590ad6202dd8715ea005ccdcd3377c0edf8b889cc1cd9d56ef6b6b12
SSDEEP 1536:9+AJHMGR4DGjFpK5sFtNTphbr1Rw4Ilp+rUmqpQ1VGHDubmfs71:DHMGR4oX9tNTphbr1Rkp+r9r2SF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftnwwckf.exe

Path \Users\Admin\AppData\Local\Temp\ftnwwckf.exe
Size 81KB
SHA256 6693e7c922c3f1976d4f6583d664a8cb992d5202521a77da5cd0be60b85829f5
MD5 fe48ec1fee1dde216ee4b92d64bae4f3
SHA1 797569015b8a844b516588383b393fd713afc74f
SHA512 b79ffb634ed0b5dc4c193ffabf2749facef47134838c1fc75542ca91127c6423d8e371ba590ad6202dd8715ea005ccdcd3377c0edf8b889cc1cd9d56ef6b6b12
SSDEEP 1536:9+AJHMGR4DGjFpK5sFtNTphbr1Rw4Ilp+rUmqpQ1VGHDubmfs71:DHMGR4oX9tNTphbr1Rkp+r9r2SF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftnwwckf.exe

Path \Users\Admin\AppData\Local\Temp\ftnwwckf.exe
Size 81KB
SHA256 6693e7c922c3f1976d4f6583d664a8cb992d5202521a77da5cd0be60b85829f5
MD5 fe48ec1fee1dde216ee4b92d64bae4f3
SHA1 797569015b8a844b516588383b393fd713afc74f
SHA512 b79ffb634ed0b5dc4c193ffabf2749facef47134838c1fc75542ca91127c6423d8e371ba590ad6202dd8715ea005ccdcd3377c0edf8b889cc1cd9d56ef6b6b12
SSDEEP 1536:9+AJHMGR4DGjFpK5sFtNTphbr1Rw4Ilp+rUmqpQ1VGHDubmfs71:DHMGR4oX9tNTphbr1Rkp+r9r2SF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1064-67-0x0000000001EF0000-0x0000000001F20000-memory.dmp

Download

memory/1064-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1132-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads