Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
04/10/2023, 14:33
General
-
Target
4eda7fdcc6081486e3a840365c46e5d069fb5c521b9eecad775456fea48c9ab3.exe
-
Size
183KB
-
MD5
0303a17fe201386700406928e5c50e48
-
SHA1
c2736ab3cd708ccd5b6fcf3244d6ac45d07c8486
-
SHA256
4eda7fdcc6081486e3a840365c46e5d069fb5c521b9eecad775456fea48c9ab3
-
SHA512
e2d6240281d829a3799d24c4c8aa0e38c2c47cc26eef6eb6a6a49dd332baf84dec09a1fd22b7ce0f7177e44e69632487736e14158b6099b401e650038b0460e0
-
SSDEEP
3072:GUI/zCt5UXBUkH+LGP34oeKerVUzeeDXbwa21Dq9ua/aHyvZR6d2iT:GUI/+t5USmbwv
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eda7fdcc6081486e3a840365c46e5d069fb5c521b9eecad775456fea48c9ab3.exe"C:\Users\Admin\AppData\Local\Temp\4eda7fdcc6081486e3a840365c46e5d069fb5c521b9eecad775456fea48c9ab3.exe"1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB