Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18-07-2023 18:47
Behavioral task
behavioral1
Sample
2752-72-0x0000000000400000-0x000000000046D000-memory.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2752-72-0x0000000000400000-0x000000000046D000-memory.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2752-72-0x0000000000400000-0x000000000046D000-memory.exe
-
Size
436KB
-
MD5
59ddee1aa8f59642aba0a86c600149ad
-
SHA1
7202045ff2ec39d24d2e48f07a1de0c9a1cb7edd
-
SHA256
51c7daba9cec9dcb856188ccb4eeea801c911591aeecd1b501f571f7cccfec7f
-
SHA512
9bb007774a87b3d9e0a866070646eec8d9605d9f0a681b44225d11001d21a681d059731efffcb1ef030126cb0f448c943a8b7c4dff2543e28b623e4d1031f77d
-
SSDEEP
12288:JWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmBcJ:2xgsRftD0C2nKGu
Score
6/10
Malware Config
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1880 set thread context of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 PID 1880 wrote to memory of 2800 1880 2752-72-0x0000000000400000-0x000000000046D000-memory.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2752-72-0x0000000000400000-0x000000000046D000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2752-72-0x0000000000400000-0x000000000046D000-memory.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2800
-
Network
-
Remote address:8.8.8.8:53Requestapi.telegram.orgIN AResponseapi.telegram.orgIN A149.154.167.220
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 132 B 4 3
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 132 B 4 3
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2
-
397 B 219 B 5 5
-
359 B 219 B 5 5
-
288 B 219 B 5 5
-
190 B 92 B 4 2