Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 11:22
Static task
static1
Behavioral task
behavioral1
Sample
notee.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
notee.exe
Resource
win10v2004-20220812-en
General
-
Target
notee.exe
-
Size
7KB
-
MD5
d3e184b081ba54e7b5cbd5dc579f4f27
-
SHA1
b7c61923ed6ac09d1aec3b7ff799548d6b6af1c8
-
SHA256
902abe7c2f1e7afb139ce47a818b11d9ff9dfe9a46cc9b9afb7d7d53bda6c528
-
SHA512
a9153828449c0ac2eb0feb465b092168b176f133034732eccfec69d4e0705e8f3acd628314b751ad0eaaff06d0b78784242ecbad1aa26783bb0dba23e95f23ee
-
SSDEEP
96:Wd7KqtBgjmLYoSrJmAkcPFn9bi/rkA86o00gazFnU:WPwHrJr9nlmAyjbt
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
notee.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation notee.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
notee.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notee.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notee.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notee.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
notee.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pqkngfy = "\"C:\\Users\\Admin\\AppData\\Roaming\\Bkpfu\\Pqkngfy.exe\"" notee.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 33 api.ipify.org 34 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
notee.exedescription pid process target process PID 1508 set thread context of 4008 1508 notee.exe notee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 5056 powershell.exe 5056 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
notee.exepowershell.exenotee.exedescription pid process Token: SeDebugPrivilege 1508 notee.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeDebugPrivilege 4008 notee.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notee.exepid process 4008 notee.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
notee.exedescription pid process target process PID 1508 wrote to memory of 5056 1508 notee.exe powershell.exe PID 1508 wrote to memory of 5056 1508 notee.exe powershell.exe PID 1508 wrote to memory of 5056 1508 notee.exe powershell.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe PID 1508 wrote to memory of 4008 1508 notee.exe notee.exe -
outlook_office_path 1 IoCs
Processes:
notee.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notee.exe -
outlook_win_path 1 IoCs
Processes:
notee.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 notee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\notee.exe"C:\Users\Admin\AppData\Local\Temp\notee.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\notee.exeC:\Users\Admin\AppData\Local\Temp\notee.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\notee.exe.logFilesize
1KB
MD53a9188331a78f1dbce606db64b841fcb
SHA18e2c99b7c477d06591a856a4ea3e1e214719eee8
SHA256db4137e258a0f6159fda559a5f6dd2704be0582c3f0586f65040c7ad1eb68451
SHA512d1a994610a045d89d5d306866c24ae56bf16555414b8f63f632552568e67b5586f26d5a17a1f0a55ada376730298e6d856e9161828d4eae9decfa4e015e0e90a
-
memory/1508-133-0x0000000006500000-0x0000000006522000-memory.dmpFilesize
136KB
-
memory/1508-132-0x0000000000470000-0x0000000000478000-memory.dmpFilesize
32KB
-
memory/4008-142-0x0000000000000000-mapping.dmp
-
memory/4008-148-0x0000000006D60000-0x0000000006DB0000-memory.dmpFilesize
320KB
-
memory/4008-147-0x0000000006C40000-0x0000000006C4A000-memory.dmpFilesize
40KB
-
memory/4008-146-0x0000000006CC0000-0x0000000006D52000-memory.dmpFilesize
584KB
-
memory/4008-145-0x0000000005960000-0x0000000005F04000-memory.dmpFilesize
5.6MB
-
memory/4008-143-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/5056-136-0x00000000053D0000-0x00000000059F8000-memory.dmpFilesize
6.2MB
-
memory/5056-141-0x00000000066F0000-0x000000000670A000-memory.dmpFilesize
104KB
-
memory/5056-140-0x0000000007A60000-0x00000000080DA000-memory.dmpFilesize
6.5MB
-
memory/5056-139-0x00000000061F0000-0x000000000620E000-memory.dmpFilesize
120KB
-
memory/5056-138-0x0000000005B60000-0x0000000005BC6000-memory.dmpFilesize
408KB
-
memory/5056-137-0x0000000005AF0000-0x0000000005B56000-memory.dmpFilesize
408KB
-
memory/5056-135-0x0000000004C10000-0x0000000004C46000-memory.dmpFilesize
216KB
-
memory/5056-134-0x0000000000000000-mapping.dmp