Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 13:11
Static task
static1
Behavioral task
behavioral1
Sample
download.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
download.exe
Resource
win10v2004-20230915-en
General
-
Target
download.exe
-
Size
64KB
-
MD5
9b2dffb5747aea1e6ccc4d2a7055bcf6
-
SHA1
dcd11aecdcf33b57fbc5528ea8509b2f942df7e8
-
SHA256
9de0c90a9ad1a1d2e8050513205b6eddf17bd22105d40779367d6789e82c9c30
-
SHA512
26e4447a2f17069f850288e7b297010ec9caeccf72de971ab86fd81436a8c573ac69106b5d321597d0bf0c51b9618e54662917594f7c4b29e8e25d93412a8e2b
-
SSDEEP
1536:fBymRmBOBI6RBTXBbBuB5BeBNz4bO9JZk+GRcX1vgzU2AY:fBxRmBOBI6RBTXBbBuB5BeBNpFvx6
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
download.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip-api.com 6 icanhazip.com -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
download.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 download.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier download.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
download.exepid process 2228 download.exe 2228 download.exe 2228 download.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
download.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2228 download.exe Token: SeRestorePrivilege 2312 msiexec.exe Token: SeTakeOwnershipPrivilege 2312 msiexec.exe Token: SeSecurityPrivilege 2312 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
download.execmd.exedescription pid process target process PID 2228 wrote to memory of 2816 2228 download.exe cmd.exe PID 2228 wrote to memory of 2816 2228 download.exe cmd.exe PID 2228 wrote to memory of 2816 2228 download.exe cmd.exe PID 2228 wrote to memory of 2816 2228 download.exe cmd.exe PID 2816 wrote to memory of 2536 2816 cmd.exe chcp.com PID 2816 wrote to memory of 2536 2816 cmd.exe chcp.com PID 2816 wrote to memory of 2536 2816 cmd.exe chcp.com PID 2816 wrote to memory of 2536 2816 cmd.exe chcp.com PID 2816 wrote to memory of 2360 2816 cmd.exe netsh.exe PID 2816 wrote to memory of 2360 2816 cmd.exe netsh.exe PID 2816 wrote to memory of 2360 2816 cmd.exe netsh.exe PID 2816 wrote to memory of 2360 2816 cmd.exe netsh.exe PID 2816 wrote to memory of 3032 2816 cmd.exe findstr.exe PID 2816 wrote to memory of 3032 2816 cmd.exe findstr.exe PID 2816 wrote to memory of 3032 2816 cmd.exe findstr.exe PID 2816 wrote to memory of 3032 2816 cmd.exe findstr.exe -
outlook_office_path 1 IoCs
Processes:
download.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe -
outlook_win_path 1 IoCs
Processes:
download.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2228-0-0x0000000000AD0000-0x0000000000AE6000-memory.dmpFilesize
88KB
-
memory/2228-1-0x0000000073EE0000-0x00000000745CE000-memory.dmpFilesize
6.9MB
-
memory/2228-2-0x0000000004160000-0x00000000041A0000-memory.dmpFilesize
256KB
-
memory/2228-3-0x0000000005500000-0x00000000055E2000-memory.dmpFilesize
904KB
-
memory/2228-4-0x0000000073EE0000-0x00000000745CE000-memory.dmpFilesize
6.9MB
-
memory/2228-5-0x0000000004160000-0x00000000041A0000-memory.dmpFilesize
256KB
-
memory/2228-35-0x0000000073EE0000-0x00000000745CE000-memory.dmpFilesize
6.9MB