1f985f1f9f3208c1d08509fabd9aefad93dea9e47026e6d289667d9c3d931656

Analysis

max time kernel
467s
max time network
410s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
09-05-2023 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

muestra.txt
Size

1.5MB
MD5

9188e0af38883f23df89ea2cbc64e6eb
SHA1

f4ff29d7d99f81eae2676091a8f6cdf37116476d
SHA256

1f985f1f9f3208c1d08509fabd9aefad93dea9e47026e6d289667d9c3d931656
SHA512

88901a05c2bb67e20e8a3a7bae3fc6f7668cc479fff1205e9a0f4781161af6013007dab62e3d114cc2145f3e5ba71fbbe655c27d4e6177a8529d3d70969e2fab
SSDEEP

24576:sBShIymxlhKpQSpyVa2NYMJXTXVnyjBc/CZQYr8hiFaVmlAbKkMK+2lhL:ed/NYM87CtRV

Score

8^/10

collection persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinManager.lnk	mcnamara.exe

Executes dropped EXE 3 IoCs

pid	Process
1816	mcnamara.exe
1732	mcnamara.exe
936	mcnamara.exe

Loads dropped DLL 3 IoCs

pid	Process
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mcnamara.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mcnamara.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mcnamara.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	mcnamara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDriver = "\"C:\\Users\\Admin\\AppData\\Roaming\\o'neill\\exe\\vsigmon\\mcnamara.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\o'neill\\exe\\vsigmon\\g2lz72g.jpg\""	mcnamara.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1740	timeout.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	NOTEPAD.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	mcnamara.exe
File opened for modification	C:\Users\Admin\Documents\winmgmts:{impersonationLevel=impersonate}!\localhost\root\SecurityCenter2	mcnamara.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
828	NOTEPAD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1952	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: 33	1500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1500	AUDIODG.EXE
Token: 33	1500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1500	AUDIODG.EXE
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe
1816	mcnamara.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
828	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1876	912	cmd.exe	35
PID 912 wrote to memory of 1876	912	cmd.exe	35
PID 912 wrote to memory of 1876	912	cmd.exe	35
PID 1876 wrote to memory of 2016	1876	cmd.exe	36
PID 1876 wrote to memory of 2016	1876	cmd.exe	36
PID 1876 wrote to memory of 2016	1876	cmd.exe	36
PID 1876 wrote to memory of 1952	1876	cmd.exe	37
PID 1876 wrote to memory of 1952	1876	cmd.exe	37
PID 1876 wrote to memory of 1952	1876	cmd.exe	37
PID 1876 wrote to memory of 1972	1876	cmd.exe	38
PID 1876 wrote to memory of 1972	1876	cmd.exe	38
PID 1876 wrote to memory of 1972	1876	cmd.exe	38
PID 1876 wrote to memory of 2024	1876	cmd.exe	39
PID 1876 wrote to memory of 2024	1876	cmd.exe	39
PID 1876 wrote to memory of 2024	1876	cmd.exe	39
PID 1876 wrote to memory of 1372	1876	cmd.exe	40
PID 1876 wrote to memory of 1372	1876	cmd.exe	40
PID 1876 wrote to memory of 1372	1876	cmd.exe	40
PID 1876 wrote to memory of 1740	1876	cmd.exe	43
PID 1876 wrote to memory of 1740	1876	cmd.exe	43
PID 1876 wrote to memory of 1740	1876	cmd.exe	43
PID 1816 wrote to memory of 1732	1816	mcnamara.exe	46
PID 1816 wrote to memory of 1732	1816	mcnamara.exe	46
PID 1816 wrote to memory of 1732	1816	mcnamara.exe	46
PID 1816 wrote to memory of 1732	1816	mcnamara.exe	46
PID 1816 wrote to memory of 936	1816	mcnamara.exe	47
PID 1816 wrote to memory of 936	1816	mcnamara.exe	47
PID 1816 wrote to memory of 936	1816	mcnamara.exe	47
PID 1816 wrote to memory of 936	1816	mcnamara.exe	47
PID 1816 wrote to memory of 552	1816	mcnamara.exe	48
PID 1816 wrote to memory of 552	1816	mcnamara.exe	48
PID 1816 wrote to memory of 552	1816	mcnamara.exe	48
PID 1816 wrote to memory of 552	1816	mcnamara.exe	48
PID 552 wrote to memory of 840	552	csc.exe	50
PID 552 wrote to memory of 840	552	csc.exe	50
PID 552 wrote to memory of 840	552	csc.exe	50
PID 552 wrote to memory of 840	552	csc.exe	50
PID 2036 wrote to memory of 1968	2036	rundll32.exe	53
PID 2036 wrote to memory of 1968	2036	rundll32.exe	53
PID 2036 wrote to memory of 1968	2036	rundll32.exe	53

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mcnamara.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	mcnamara.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\muestra.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:828

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Documents\muestra.cmd" "
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\Documents\muestra.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\more.com
    more +5 C:\Users\Admin\Documents\muestra.cmd
    3⤵
    PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(gc ~~) -replace '<', '' | Out-File -encoding ASCII ~~"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\system32\certutil.exe
    certutil -decode -f ~~ "C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe"
    3⤵
    PID:1972
- - C:\Windows\system32\certutil.exe
    certutil -decode -f C:\Users\Admin\Documents\muestra.cmd "C:\Users\Admin\AppData\Roaming\o'neill\a3x\benitez\muestra.a3x"
    3⤵
    PID:2024
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process call create '"C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe" "C:\Users\Admin\AppData\Roaming\o'neill\a3x\benitez\muestra.a3x" ""' ,C:\Users\Admin\Documents\
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- - C:\Windows\system32\timeout.exe
    timeout /T 5
    3⤵
    - Delays execution with timeout.exe
    PID:1740

C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe
"C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe" "C:\Users\Admin\AppData\Roaming\o'neill\a3x\benitez\muestra.a3x" ""
1⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1816
- C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe
  "C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe" C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\g2lz72g.jpg
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe
  C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe /AutoIt3ExecuteLine "MsgBox(262144, 'Error de emision', 'Este e-mail ha sido enviado por error y ha sido revocado por su emisor. Por favor haga caso omiso a este e-mail.')"
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\awc5drm0\awc5drm0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53FB.tmp" "c:\Users\Admin\AppData\Local\Temp\awc5drm0\CSCEC96984BFE144C1586B0E24991987B8.TMP"
    3⤵
    PID:840

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\~~
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\~~
  2⤵
  PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES53FB.tmp

Filesize
1KB

MD5
01d02c22856b2a43f1ede3f73c39f0c3

SHA1
16bf956cc24e523a699d812e96d97f23365f79fc

SHA256
91bd880e1b01e22e019238621a9c3cf042f05bb719b4c05565957fd5495048a6

SHA512
f5b28490fe1938d76f406b4ce699f60ac8a2587088d1400a8a91c976ef358965ec12a6c7d1d3d0eff9e7a9fb0747c5d55ca968d25a721f75f0ae5a44f2c848dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\awc5drm0\awc5drm0.dll

Filesize
21KB

MD5
f0283b67ce0c9ea27e20656b0cae272f

SHA1
42fb6e47b8cf1b75b83701c1e15ca5e0bcc1ce0f

SHA256
a207c8a60b4dbb76f09daff86954046278b23a39b354e5c47f2dd8f603f5a8be

SHA512
51a13074ce38b6de07a9b6550ac7779011a98ec0002fd03aec8a41bb8a60b326f8fdad64d609e45ca1af549ac319bd044a305b5c8d671b0d44c382511dc4d030

Download Submit
C:\Users\Admin\AppData\Local\Temp\awc5drm0\awc5drm0.pdb

Filesize
21KB

MD5
aaffc8296ad80a06bccfd79f4e4d44fe

SHA1
08fb808317da2f1a1003fa5c9320f2259e30311d

SHA256
6120456ff144620518e6a0c4019db5c9ba5e9780b6ac6df8d7884dc3255409ea

SHA512
157907cec34cb00a3787766a961c261849c5f611dae3e746fe8e67229fa9c424506a421711c75950ee8d99657587477011c14d59849890acc46c6514011d88ed

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\2023\gilbert.txt

Filesize
321B

MD5
1fe96da97eeedc7b4f3fe331f068e5f1

SHA1
43c1a99587e10802da4f9a4122e7640d555a264b

SHA256
d969529c165c01641e89a0230f935be4b4394bb5987d8b4c399cc7d597b880a1

SHA512
578352fdcda509dfc6e13f0fd40a322b2e14ee4188be30e60598c747b8e4a7d4c7e4f4cf6765b91417fae54014377761bb669ee5c05c639f25104c9e4f13fb6d

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\a3x\benitez\Independentsoft.Pst.dll

Filesize
7KB

MD5
fdee8f50196535141dbc46df92152652

SHA1
944b1127501770da3f3dc83b4075bde253327018

SHA256
18678f877b1b2f69e4c70338dbbcbadc84cf8973a74b6440b9742f987952ca5a

SHA512
93855b00b9fc691e96febdf657f78552882f07dd14f133cd61e28bdf8e4ad7235c5e23bf79f7e4ee29a02d3c6f7293771f3fb0a5cfebf928f5aa42077ca4411a

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\a3x\benitez\muestra.a3x

Filesize
146KB

MD5
b48040f3c14694b4f605222c1f333599

SHA1
f76e6ea02058f3a32a4f14445aa6d0bc586a4007

SHA256
673b032db9749fc1ee0cff3d051b60e320a39b9a9b83c454c4c6c1bcc9e9dfee

SHA512
2a0a9309ceaa9cbea27a058431745ff83e707cb6a38fac7bd944cd612b95704b33d3004e48596a330ac038298b03934ca92ba59b40801c82f4071f1474d6eb65

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\g2lz72g.jpg

Filesize
7KB

MD5
fdee8f50196535141dbc46df92152652

SHA1
944b1127501770da3f3dc83b4075bde253327018

SHA256
18678f877b1b2f69e4c70338dbbcbadc84cf8973a74b6440b9742f987952ca5a

SHA512
93855b00b9fc691e96febdf657f78552882f07dd14f133cd61e28bdf8e4ad7235c5e23bf79f7e4ee29a02d3c6f7293771f3fb0a5cfebf928f5aa42077ca4411a

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\Documents\muestra.cmd

Filesize
1.5MB

MD5
9188e0af38883f23df89ea2cbc64e6eb

SHA1
f4ff29d7d99f81eae2676091a8f6cdf37116476d

SHA256
1f985f1f9f3208c1d08509fabd9aefad93dea9e47026e6d289667d9c3d931656

SHA512
88901a05c2bb67e20e8a3a7bae3fc6f7668cc479fff1205e9a0f4781161af6013007dab62e3d114cc2145f3e5ba71fbbe655c27d4e6177a8529d3d70969e2fab

Download Submit
C:\Users\Admin\Documents\~~

Filesize
1.5MB

MD5
b3393405c57b2e0a93b3d39ef776a51b

SHA1
3b854feca62952c263ae8ffd0ceacfc277f0c954

SHA256
c0bc90ba536d5ecb2bdc9336a1a57baf32bdb326d2e2ea3b8ee5cf43be38eb23

SHA512
b815cc4eac14c2d40bb003ba758ae790d8263a138492ee8a369ac3db6d3d4f9aabc123a96a0a7de40e9c2af8e29b554190e10ec05fb275820ce56a76debc3229

Download Submit
C:\Users\Admin\Documents\~~

Filesize
1.4MB

MD5
9be676e0b1383e7b1607f98b8f53ae6f

SHA1
eba3d44cc81c23748333ef1beb159cb26cf96d66

SHA256
3f7aeef2fcba3b2d2d449fc17b8d4e30e95358d0493e2f72b55ba40c730918e8

SHA512
1563fa455a7e0146b59e59d428ec6e61c265c8261f5284a397e91a842acb18769a17aba08f7dd4d00bf3f4159f08cd6c5b7c461858dc96b6392958218209aeed

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\awc5drm0\CSCEC96984BFE144C1586B0E24991987B8.TMP

Filesize
652B

MD5
23ca20cf22b6547a86b255a3a85df7f4

SHA1
567ff399eb196551c26bf7410ae4e547301e6719

SHA256
3a4ca6a2042022d626946ff3250570933e339ad9cb48b24d2fe03d2a0d17f430

SHA512
7f0e0f2463956849ac9cbd34702abce5aee288fcd3ed3639969a8c710fd0bd1ed85449fee34e6f35dc7cedcb5963e8204c44bc1dbbe983f140f564cd82dfebd3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\awc5drm0\awc5drm0.0.cs

Filesize
11KB

MD5
685047822d8b050f66f3bd3993c316c8

SHA1
b5f87885c70a8eb5528decf7e2e45309be402bff

SHA256
5079f2ec267a6d413bfb8e26c7adfe1358a3c4f8448b75b8a8de8df5d94c885d

SHA512
2cee08f1ea3d87fe5346608dab1db674668ece501b767d2de4fe4ed13aa5dea1704a99819d976bf5160d36b1035c05f4ed9c0077c630c728c1102f845826ddac

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\awc5drm0\awc5drm0.cmdline

Filesize
454B

MD5
d169400551767f2f31d47b61b3888a92

SHA1
fe7c326e44909d60434cea3a1021bc1affc53839

SHA256
3bd1d1d4ff0dd6ba7814ddfb04daac855558e325a0f04b9a4ab79a6d2cff15ad

SHA512
1565dde97fe96523308ef0060c518d555176b8a04aef0508cb721a605e551eeb3a2d822aa14a4f51dbaf242d10a889999f3e164320e14ec03e4da17a3b24123a

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
858KB

MD5
c7719f774bb859240eb6dfa91a1f10be

SHA1
be1461e770333eb13e0fe66d378e3fac4f1112b5

SHA256
b3ce811fb696b94f9117ee7fe725ae6b907d695636beceeb1672d5d5eeb81df4

SHA512
8a561e927a7a65f5211c76b488bed2a3cc0525ecd9775d25e1863b52ff532349c125b76a51eb63ea2e4479a567e8fac6b8ae38b7fd1970bad2556befe9e3b529

Download Submit
\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
\Users\Admin\AppData\Roaming\o'neill\exe\vsigmon\mcnamara.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
memory/828-54-0x0000000003B70000-0x0000000003B80000-memory.dmp

Filesize
64KB

Download
memory/828-55-0x0000000003940000-0x0000000003941000-memory.dmp

Filesize
4KB

Download
memory/828-57-0x0000000003940000-0x0000000003941000-memory.dmp

Filesize
4KB

Download
memory/1816-114-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1816-125-0x00000000031B0000-0x00000000031BC000-memory.dmp

Filesize
48KB

Download
memory/1816-115-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/1816-112-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/1816-113-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/1952-69-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/1952-67-0x00000000029C0000-0x0000000002A06000-memory.dmp

Filesize
280KB

Download
memory/1952-75-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/1952-74-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/1952-71-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1952-66-0x0000000001DB0000-0x0000000001DBE000-memory.dmp

Filesize
56KB

Download
memory/1952-65-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/1952-64-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/1952-70-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/1952-68-0x0000000001DD0000-0x0000000001DDA000-memory.dmp

Filesize
40KB

Download
memory/1952-72-0x000000001B200000-0x000000001B24E000-memory.dmp

Filesize
312KB

Download