Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
02/08/2023, 08:47
General
- Target 5789987654SKL.exe
- Size 663KB
- Sample230802-kpv6eadf94
- SHA256 8227055b0090562a073fd35b7ddd31091d00a279ffadf9835b175ac659a89b53
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.sienkakupeste.com
-
Port
587
-
Username
-
Password
010203sienka++
Signatures
- Drops startup file 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5789987654SKL.exe"C:\Users\Admin\AppData\Local\Temp\5789987654SKL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\5789987654SKL.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\5789987654SKL.exe"C:\Users\Admin\AppData\Local\Temp\5789987654SKL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5789987654SKL.exe.log
__PSScriptPolicyTest_ocqulm2g.zoe.ps1
memory/3676-172-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/3676-171-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/3676-155-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3676-160-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/3676-173-0x0000000006AD0000-0x0000000006ADA000-memory.dmp
memory/3676-169-0x0000000006990000-0x00000000069E0000-memory.dmp
memory/3676-159-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/3676-170-0x0000000006BB0000-0x0000000006D72000-memory.dmp
memory/4396-136-0x0000000004F80000-0x0000000005012000-memory.dmp
memory/4396-133-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/4396-135-0x0000000005490000-0x0000000005A34000-memory.dmp
memory/4396-138-0x0000000005170000-0x0000000005180000-memory.dmp
memory/4396-137-0x0000000005180000-0x000000000521C000-memory.dmp
memory/4396-157-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/4396-134-0x0000000000520000-0x00000000005CC000-memory.dmp
memory/4688-140-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/4688-150-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/4688-161-0x0000000005AD0000-0x0000000005AEE000-memory.dmp
memory/4688-162-0x0000000006AD0000-0x0000000006B66000-memory.dmp
memory/4688-163-0x0000000005FB0000-0x0000000005FCA000-memory.dmp
memory/4688-164-0x0000000006030000-0x0000000006052000-memory.dmp
memory/4688-168-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/4688-144-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/4688-143-0x0000000004B00000-0x0000000004B22000-memory.dmp
memory/4688-142-0x0000000004B90000-0x00000000051B8000-memory.dmp
memory/4688-141-0x0000000004550000-0x0000000004560000-memory.dmp
memory/4688-139-0x0000000004500000-0x0000000004536000-memory.dmp