Analysis
-
max time kernel
191s -
max time network
225s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 13:11
Static task
static1
Behavioral task
behavioral1
Sample
download.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
download.exe
Resource
win10v2004-20230915-en
General
-
Target
download.exe
-
Size
64KB
-
MD5
9b2dffb5747aea1e6ccc4d2a7055bcf6
-
SHA1
dcd11aecdcf33b57fbc5528ea8509b2f942df7e8
-
SHA256
9de0c90a9ad1a1d2e8050513205b6eddf17bd22105d40779367d6789e82c9c30
-
SHA512
26e4447a2f17069f850288e7b297010ec9caeccf72de971ab86fd81436a8c573ac69106b5d321597d0bf0c51b9618e54662917594f7c4b29e8e25d93412a8e2b
-
SSDEEP
1536:fBymRmBOBI6RBTXBbBuB5BeBNz4bO9JZk+GRcX1vgzU2AY:fBxRmBOBI6RBTXBbBuB5BeBNpFvx6
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
download.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 71 ip-api.com 63 icanhazip.com -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
download.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 download.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier download.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
download.exepid process 2096 download.exe 2096 download.exe 2096 download.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
download.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2096 download.exe Token: SeSecurityPrivilege 2156 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
download.execmd.exedescription pid process target process PID 2096 wrote to memory of 5020 2096 download.exe cmd.exe PID 2096 wrote to memory of 5020 2096 download.exe cmd.exe PID 2096 wrote to memory of 5020 2096 download.exe cmd.exe PID 5020 wrote to memory of 3124 5020 cmd.exe chcp.com PID 5020 wrote to memory of 3124 5020 cmd.exe chcp.com PID 5020 wrote to memory of 3124 5020 cmd.exe chcp.com PID 5020 wrote to memory of 2084 5020 cmd.exe netsh.exe PID 5020 wrote to memory of 2084 5020 cmd.exe netsh.exe PID 5020 wrote to memory of 2084 5020 cmd.exe netsh.exe PID 5020 wrote to memory of 3876 5020 cmd.exe findstr.exe PID 5020 wrote to memory of 3876 5020 cmd.exe findstr.exe PID 5020 wrote to memory of 3876 5020 cmd.exe findstr.exe -
outlook_office_path 1 IoCs
Processes:
download.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe -
outlook_win_path 1 IoCs
Processes:
download.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 download.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2096-0-0x0000000000980000-0x0000000000996000-memory.dmpFilesize
88KB
-
memory/2096-1-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2096-2-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/2096-3-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2096-4-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/2096-5-0x0000000005CC0000-0x0000000005DA2000-memory.dmpFilesize
904KB
-
memory/2096-6-0x0000000005F10000-0x0000000005F76000-memory.dmpFilesize
408KB
-
memory/2096-7-0x0000000006690000-0x00000000066A2000-memory.dmpFilesize
72KB
-
memory/2096-8-0x0000000007200000-0x00000000073C2000-memory.dmpFilesize
1.8MB
-
memory/2096-27-0x0000000007980000-0x0000000007F24000-memory.dmpFilesize
5.6MB
-
memory/2096-30-0x0000000006130000-0x00000000061C2000-memory.dmpFilesize
584KB
-
memory/2096-40-0x00000000061D0000-0x0000000006246000-memory.dmpFilesize
472KB