afc282bc05bba0fc2376caf8a82a72c1e708620fae92b1df63575132f159802a

General

Target

Quote_specifications 09321_PDF.exe
Size

331KB
MD5

dcb80e6ddebe648cc889c3c4fdbc1140
SHA1

405b0cdb08732a2fa8c8b71ff2b962fe2bad4a1c
SHA256

afc282bc05bba0fc2376caf8a82a72c1e708620fae92b1df63575132f159802a
SHA512

7d5ed4666b0121cb41d5a71fd2144320730e9166581c2a57064ca49da9c6f6480b514ec29806f785ea37193b6abfd7570b0d17a9db294790d4006faceea1ce34
SSDEEP

6144:9Ya6tmSVQonSN1rUfxr6wggwhB/BNjee9e+bjCF1eVMhLkK2ge1h9Xhj6NodEaVN:9YPJVtSfIfAwgfhFH/eE4eVMhLj2gs7F

Score

10^/10

collection spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.ravv.sk
Port:
587
Username:
[email protected]
Password:
bfE#vKaMi#

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4772	ttrruxbubs.exe
4732	ttrruxbubs.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ttrruxbubs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ttrruxbubs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ttrruxbubs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 4732	4772	ttrruxbubs.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4772	ttrruxbubs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	ttrruxbubs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4772	4136	Quote_specifications 09321_PDF.exe	82
PID 4136 wrote to memory of 4772	4136	Quote_specifications 09321_PDF.exe	82
PID 4136 wrote to memory of 4772	4136	Quote_specifications 09321_PDF.exe	82
PID 4772 wrote to memory of 4732	4772	ttrruxbubs.exe	83
PID 4772 wrote to memory of 4732	4772	ttrruxbubs.exe	83
PID 4772 wrote to memory of 4732	4772	ttrruxbubs.exe	83
PID 4772 wrote to memory of 4732	4772	ttrruxbubs.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ttrruxbubs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ttrruxbubs.exe

C:\Users\Admin\AppData\Local\Temp\Quote_specifications 09321_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Quote_specifications 09321_PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe
  "C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe" C:\Users\Admin\AppData\Local\Temp\afeqjhsy.qa
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe
    "C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\afeqjhsy.qa

Filesize
5KB

MD5
e958ce0932ddfb26d0e894611c845d60

SHA1
d4f33e4896cf2ed63250f20e80a747ea5d504549

SHA256
d68db254d17a75c155462b9cc8a7d3c734d043186ee7e9c59a3d35c34a48915b

SHA512
c122bd2f2a02c68c623ea150db5c622bcabe061830bb432d381caa55f9b3ddefccf2ff82b0b397d96ea605decf718d554ffc3b3ce99b0692585bde5e05b639ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\bocptip.o

Filesize
265KB

MD5
3adf78704f95a3515f79e5d3ade9d745

SHA1
0d0c686e107da49ae37913c174599ad06b58cd26

SHA256
6a8814cd64158343a45cc7c2ebf51015d93c38a7d1958fe2e8cf2b8ab366f629

SHA512
08cac0d041c6b13e7525e7f2c82cc932c4c40642c916dc26ee785d35fd6db6a509dcd63c5eb53f16807fe5ba7b0e81d45b02ae78675ba7b53203abc1c4ca0f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe

Filesize
164KB

MD5
ad2bd6ca36440aa815d87df49b501224

SHA1
bfded28b6f5e5a55d9559d3508f8525e1e92cc50

SHA256
5ce328542651a00d461df2bd7a7f471059c0f073712e1a9e40d70cdcbae24ee0

SHA512
f1c8f38e760d6dfca4eb6e0ddeb7a5550312efb0b4f409ca4d6f666922c0a8c71164192d8f72dd174420a2a51b789b8b9eca21883646d719f76693a9b0f80c8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe

Filesize
164KB

MD5
ad2bd6ca36440aa815d87df49b501224

SHA1
bfded28b6f5e5a55d9559d3508f8525e1e92cc50

SHA256
5ce328542651a00d461df2bd7a7f471059c0f073712e1a9e40d70cdcbae24ee0

SHA512
f1c8f38e760d6dfca4eb6e0ddeb7a5550312efb0b4f409ca4d6f666922c0a8c71164192d8f72dd174420a2a51b789b8b9eca21883646d719f76693a9b0f80c8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttrruxbubs.exe

Filesize
164KB

MD5
ad2bd6ca36440aa815d87df49b501224

SHA1
bfded28b6f5e5a55d9559d3508f8525e1e92cc50

SHA256
5ce328542651a00d461df2bd7a7f471059c0f073712e1a9e40d70cdcbae24ee0

SHA512
f1c8f38e760d6dfca4eb6e0ddeb7a5550312efb0b4f409ca4d6f666922c0a8c71164192d8f72dd174420a2a51b789b8b9eca21883646d719f76693a9b0f80c8e

Download Submit
memory/4732-139-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4732-140-0x0000000005960000-0x0000000005F04000-memory.dmp

Filesize
5.6MB

Download
memory/4732-141-0x0000000005420000-0x0000000005486000-memory.dmp

Filesize
408KB

Download
memory/4732-142-0x0000000006AE0000-0x0000000006B72000-memory.dmp

Filesize
584KB

Download
memory/4732-143-0x0000000006AB0000-0x0000000006ABA000-memory.dmp

Filesize
40KB

Download
memory/4732-144-0x0000000006D60000-0x0000000006DB0000-memory.dmp

Filesize
320KB

Download
memory/4732-145-0x0000000006F80000-0x0000000007142000-memory.dmp

Filesize
1.8MB

Download
memory/4732-146-0x0000000006E50000-0x0000000006EEC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing