Analysis
- max time kernel
143s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
18/07/2023, 12:49
General
- Target IB_23071847557_attachment.exe
- Size 694KB
- Sample230718-p2cbaaac87
- SHA256 ea14e71e40ef5c0214b407a983fc0c540ccccbbde1a8479c55adabe286469589
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IB_23071847557_attachment.exe"C:\Users\Admin\AppData\Local\Temp\IB_23071847557_attachment.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NzqecVt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NzqecVt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp45ED.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_c4tp34vs.wld.ps1
tmp45ED.tmp
memory/1632-178-0x0000000006AF0000-0x0000000006B0E000-memory.dmp
memory/1632-150-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/1632-188-0x0000000074890000-0x0000000075040000-memory.dmp
memory/1632-185-0x0000000007BA0000-0x0000000007BA8000-memory.dmp
memory/1632-184-0x0000000007BB0000-0x0000000007BCA000-memory.dmp
memory/1632-183-0x0000000007AB0000-0x0000000007ABE000-memory.dmp
memory/1632-182-0x0000000007AE0000-0x0000000007B76000-memory.dmp
memory/1632-146-0x0000000002C00000-0x0000000002C36000-memory.dmp
memory/1632-153-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/1632-148-0x0000000074890000-0x0000000075040000-memory.dmp
memory/1632-149-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/1632-179-0x0000000007EA0000-0x000000000851A000-memory.dmp
memory/1632-151-0x0000000005760000-0x0000000005D88000-memory.dmp
memory/1632-152-0x0000000005670000-0x0000000005692000-memory.dmp
memory/1632-181-0x00000000078D0000-0x00000000078DA000-memory.dmp
memory/1632-164-0x0000000006560000-0x000000000657E000-memory.dmp
memory/1632-180-0x0000000007860000-0x000000000787A000-memory.dmp
memory/1632-154-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/1632-165-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/1632-166-0x000000007F300000-0x000000007F310000-memory.dmp
memory/1632-167-0x0000000006B10000-0x0000000006B42000-memory.dmp
memory/1632-168-0x000000006F470000-0x000000006F4BC000-memory.dmp
memory/1756-134-0x00000000000E0000-0x0000000000194000-memory.dmp
memory/1756-133-0x0000000074890000-0x0000000075040000-memory.dmp
memory/1756-135-0x0000000005270000-0x0000000005814000-memory.dmp
memory/1756-136-0x0000000004BF0000-0x0000000004C82000-memory.dmp
memory/1756-141-0x0000000008990000-0x0000000008A2C000-memory.dmp
memory/1756-140-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/1756-139-0x0000000074890000-0x0000000075040000-memory.dmp
memory/1756-138-0x0000000004BB0000-0x0000000004BBA000-memory.dmp
memory/1756-137-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/1756-189-0x0000000009770000-0x0000000009932000-memory.dmp