Overview
overview
10Static
static
100014c57bfd...3b.exe
windows10-1703-x64
100014c57bfd...3b.exe
windows10-2004-x64
10660e3fcc23...81.exe
windows10-1703-x64
7660e3fcc23...81.exe
windows10-2004-x64
79dc5600bed...30.exe
windows10-1703-x64
109dc5600bed...30.exe
windows10-2004-x64
10Acwpn.exe
windows10-1703-x64
10Acwpn.exe
windows10-2004-x64
7DHL SHIPPI...DF.exe
windows10-1703-x64
10DHL SHIPPI...DF.exe
windows10-2004-x64
10Halkbank_E...f..exe
windows10-1703-x64
10Halkbank_E...f..exe
windows10-2004-x64
10INVOICEXAN...LS.rtf
windows10-1703-x64
1INVOICEXAN...LS.rtf
windows10-2004-x64
1Maersk Shi...cs.exe
windows10-1703-x64
10Maersk Shi...cs.exe
windows10-2004-x64
10ORDER INQU...01.exe
windows10-1703-x64
10ORDER INQU...01.exe
windows10-2004-x64
10PO-8372929.xls
windows10-1703-x64
1PO-8372929.xls
windows10-2004-x64
1QUOTATION 1.rtf
windows10-1703-x64
1QUOTATION 1.rtf
windows10-2004-x64
1Quotation.rtf
windows10-1703-x64
1Quotation.rtf
windows10-2004-x64
1e1cf593726...1b.exe
windows10-1703-x64
10e1cf593726...1b.exe
windows10-2004-x64
10macintosh.xlsx
windows10-1703-x64
1macintosh.xlsx
windows10-2004-x64
1Resubmissions
01-02-2023 17:02
230201-vj6p3aah39 1001-02-2023 17:00
230201-vjf5eacg4s 1001-02-2023 16:57
230201-vgbrxacg2y 10Analysis
-
max time kernel
372s -
max time network
436s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
01-02-2023 17:02
Behavioral task
behavioral1
Sample
0014c57bfd62d2929bbad91d67b77c3b.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
0014c57bfd62d2929bbad91d67b77c3b.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
660e3fcc23c3a833e6e8af22b13ebd81.exe
Resource
win10-20220901-en
Behavioral task
behavioral4
Sample
660e3fcc23c3a833e6e8af22b13ebd81.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
9dc5600bedda76a29aa0e33da951fc30.exe
Resource
win10-20220812-en
Behavioral task
behavioral6
Sample
9dc5600bedda76a29aa0e33da951fc30.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Acwpn.exe
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
Acwpn.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
DHL SHIPPING DOC PDF.exe
Resource
win10-20220812-en
Behavioral task
behavioral10
Sample
DHL SHIPPING DOC PDF.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Halkbank_Ekstre_20230129_075423_612150o.pdf..exe
Resource
win10-20220901-en
Behavioral task
behavioral12
Sample
Halkbank_Ekstre_20230129_075423_612150o.pdf..exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
INVOICEXANDXBANKXDETAILS.rtf
Resource
win10-20220812-en
Behavioral task
behavioral14
Sample
INVOICEXANDXBANKXDETAILS.rtf
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Maersk Shipping Docs.exe
Resource
win10-20220812-en
Behavioral task
behavioral16
Sample
Maersk Shipping Docs.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
ORDER INQUIRY 20230201.exe
Resource
win10-20220812-en
Behavioral task
behavioral18
Sample
ORDER INQUIRY 20230201.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
PO-8372929.xls
Resource
win10-20220812-en
Behavioral task
behavioral20
Sample
PO-8372929.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
QUOTATION 1.rtf
Resource
win10-20220812-en
Behavioral task
behavioral22
Sample
QUOTATION 1.rtf
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Quotation.rtf
Resource
win10-20220812-en
Behavioral task
behavioral24
Sample
Quotation.rtf
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
e1cf59372694c7d46d84d0139b40d41b.exe
Resource
win10-20220812-en
Behavioral task
behavioral26
Sample
e1cf59372694c7d46d84d0139b40d41b.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
macintosh.xlsx
Resource
win10-20220901-en
Behavioral task
behavioral28
Sample
macintosh.xlsx
Resource
win10v2004-20221111-en
General
-
Target
660e3fcc23c3a833e6e8af22b13ebd81.exe
-
Size
172KB
-
MD5
660e3fcc23c3a833e6e8af22b13ebd81
-
SHA1
3966263baa4e4e511fe383910555ef5ceaa40914
-
SHA256
0ea47499aa08a0ed53a42fd19259cb677b4f87446f7fa7609b650f18d327de72
-
SHA512
bd6a1f83620d13a2a58fa31070237884d1a56dcedc23768768a94b4433d80a9f5affa5ae1aae8dee55a189026fa3fb68c2d433da4f7a955c13a46b314194583e
-
SSDEEP
3072:P44CG54MEA4qmNCNqiSnVm6BY1T2gg/HvV0qZ1+ipTraV8u1VcGLT9XM:Aveu/TMsiaeA/H/P+Ck
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
660e3fcc23c3a833e6e8af22b13ebd81.exedescription pid process target process PID 1940 set thread context of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 3752 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 3752 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
660e3fcc23c3a833e6e8af22b13ebd81.exedescription pid process target process PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe PID 1940 wrote to memory of 3752 1940 660e3fcc23c3a833e6e8af22b13ebd81.exe RegAsm.exe -
outlook_office_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
outlook_win_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\660e3fcc23c3a833e6e8af22b13ebd81.exe"C:\Users\Admin\AppData\Local\Temp\660e3fcc23c3a833e6e8af22b13ebd81.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1940-120-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-121-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-122-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-123-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-124-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-125-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-126-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-127-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-128-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-129-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-130-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-131-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-132-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-133-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-134-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-135-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-136-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-137-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-138-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-139-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-140-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-141-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-142-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-143-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-144-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-145-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-146-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-147-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-148-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-149-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-150-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-151-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-152-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-153-0x00000000004B0000-0x00000000004E2000-memory.dmpFilesize
200KB
-
memory/1940-154-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-155-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-158-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-160-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-161-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-159-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-157-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-156-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-162-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-163-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-164-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-165-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-166-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1940-167-0x0000000004CD0000-0x0000000004D36000-memory.dmpFilesize
408KB
-
memory/1940-171-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-169-0x0000000000415D7E-mapping.dmp
-
memory/3752-173-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-174-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-176-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-178-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-182-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-184-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-186-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-185-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-183-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-181-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-180-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-179-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-177-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-175-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-172-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-170-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3752-168-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3752-220-0x0000000005AD0000-0x0000000005FCE000-memory.dmpFilesize
5.0MB
-
memory/3752-222-0x00000000055D0000-0x000000000566C000-memory.dmpFilesize
624KB
-
memory/3752-227-0x0000000005FD0000-0x0000000006192000-memory.dmpFilesize
1.8MB
-
memory/3752-228-0x00000000057B0000-0x0000000005842000-memory.dmpFilesize
584KB
-
memory/3752-232-0x0000000005790000-0x000000000579A000-memory.dmpFilesize
40KB