Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2023 13:43
Behavioral task
behavioral1
Sample
b9c569de1ab489e0c59b63c67.exe
Resource
win7-20230703-en
General
-
Target
b9c569de1ab489e0c59b63c67.exe
-
Size
91KB
-
MD5
b9c569de1ab489e0c59b63c67ea7d246
-
SHA1
90b24db43bf99e8afe907674c32f179e2e148cf4
-
SHA256
f9dfede1853829ca67388699b8d6b8571e1b8e0954ae4afdd400e139a07c6ce2
-
SHA512
7defdc185f159138100d3e74867272705d8c8f1e2d5e82323f7aaf648f7ff240e9a269731752af7a4f4f294f01c1268b3c651a07f5a368dd2581a02e38309dff
-
SSDEEP
1536:Ejti2vkF84qTBx1qOWopAFZaSYs405K3aiOacCTvdkzkwNM8:k44kGPqqAFk5s4CiOalwy8
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
b9c569de1ab489e0c59b63c67.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts b9c569de1ab489e0c59b63c67.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
b9c569de1ab489e0c59b63c67.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook b9c569de1ab489e0c59b63c67.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
b9c569de1ab489e0c59b63c67.exedescription pid process Token: SeImpersonatePrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeTcbPrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeChangeNotifyPrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeCreateTokenPrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeBackupPrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeRestorePrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeIncreaseQuotaPrivilege 436 b9c569de1ab489e0c59b63c67.exe Token: SeAssignPrimaryTokenPrivilege 436 b9c569de1ab489e0c59b63c67.exe -
outlook_win_path 1 IoCs
Processes:
b9c569de1ab489e0c59b63c67.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook b9c569de1ab489e0c59b63c67.exe