Analysis
-
max time kernel
1798s -
max time network
1609s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
18-01-2024 03:36
Behavioral task
behavioral1
Sample
PcOptimizer.exe
Resource
win10-20231215-en
General
-
Target
PcOptimizer.exe
-
Size
1.6MB
-
MD5
31578327d2ce62a033df100eb8e5db21
-
SHA1
abbf90eb2b2064181f9d2e2b3839d32b8608607f
-
SHA256
ccb9b6b18a926cb5429ce957478416a5bbe19b9124521d1974454d0ff0fde17e
-
SHA512
6980ee171e1614414bfd3b2314adeab2df00a1447449ddf7f41ea9328ae4dc99cdd3850541f22a6ba080d40e84e66fb4b085eb8e37aa187d10e7af4693e0cdc8
-
SSDEEP
49152:JkTq24GjdGSiqkqXfd+/9AqYanieKdsS:J1EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1197035124232028301/sHUczEA6_tw3a11veY_04e7UYZLqHfIVPsGIZS0Vw4ap6GVt8E0gj0TGwqKyyPopNMrA
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
PcOptimizer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PcOptimizer.exe Key opened \REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PcOptimizer.exe Key opened \REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PcOptimizer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 icanhazip.com -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
PcOptimizer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 PcOptimizer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier PcOptimizer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
PcOptimizer.exetaskmgr.exepid process 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe 4756 PcOptimizer.exe 4756 PcOptimizer.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
PcOptimizer.exepid process 4756 PcOptimizer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
PcOptimizer.exemsiexec.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4756 PcOptimizer.exe Token: SeSecurityPrivilege 1452 msiexec.exe Token: SeDebugPrivilege 924 taskmgr.exe Token: SeSystemProfilePrivilege 924 taskmgr.exe Token: SeCreateGlobalPrivilege 924 taskmgr.exe Token: 33 924 taskmgr.exe Token: SeIncBasePriorityPrivilege 924 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PcOptimizer.exepid process 4756 PcOptimizer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
PcOptimizer.execmd.execmd.exedescription pid process target process PID 4756 wrote to memory of 5032 4756 PcOptimizer.exe cmd.exe PID 4756 wrote to memory of 5032 4756 PcOptimizer.exe cmd.exe PID 4756 wrote to memory of 5032 4756 PcOptimizer.exe cmd.exe PID 5032 wrote to memory of 3320 5032 cmd.exe chcp.com PID 5032 wrote to memory of 3320 5032 cmd.exe chcp.com PID 5032 wrote to memory of 3320 5032 cmd.exe chcp.com PID 5032 wrote to memory of 1164 5032 cmd.exe netsh.exe PID 5032 wrote to memory of 1164 5032 cmd.exe netsh.exe PID 5032 wrote to memory of 1164 5032 cmd.exe netsh.exe PID 5032 wrote to memory of 1160 5032 cmd.exe findstr.exe PID 5032 wrote to memory of 1160 5032 cmd.exe findstr.exe PID 5032 wrote to memory of 1160 5032 cmd.exe findstr.exe PID 4756 wrote to memory of 3208 4756 PcOptimizer.exe cmd.exe PID 4756 wrote to memory of 3208 4756 PcOptimizer.exe cmd.exe PID 4756 wrote to memory of 3208 4756 PcOptimizer.exe cmd.exe PID 3208 wrote to memory of 716 3208 cmd.exe chcp.com PID 3208 wrote to memory of 716 3208 cmd.exe chcp.com PID 3208 wrote to memory of 716 3208 cmd.exe chcp.com PID 3208 wrote to memory of 2340 3208 cmd.exe netsh.exe PID 3208 wrote to memory of 2340 3208 cmd.exe netsh.exe PID 3208 wrote to memory of 2340 3208 cmd.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
PcOptimizer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PcOptimizer.exe -
outlook_win_path 1 IoCs
Processes:
PcOptimizer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PcOptimizer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PcOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\PcOptimizer.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4756 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3320
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:1164
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:1160
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:716
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:2340
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\78c09df400ba7309548c26aa73a1ee26\Admin@CFZMTHEF_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\78c09df400ba7309548c26aa73a1ee26\Admin@CFZMTHEF_en-US\Directories\OneDrive.txt
Filesize25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
C:\Users\Admin\AppData\Local\78c09df400ba7309548c26aa73a1ee26\Admin@CFZMTHEF_en-US\Directories\Startup.txt
Filesize24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\78c09df400ba7309548c26aa73a1ee26\Admin@CFZMTHEF_en-US\Directories\Videos.txt
Filesize23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
4KB
MD51efa189820620a27e59f77d8f16b0e35
SHA1c0ec03434375bec1f693d569077576f7d16c1407
SHA2568bfa30c18c019101ce7b848a428994dfdc4d925db3276bbb6d541fa55e4802fd
SHA5129651b4eb6eac841228818aa2ab17c2a76640c1a46f686953f83476489f8e390baa9b5b4a0d28ae4a99cc6f8384ed977bb38cf41ab50df08608a7f62d39851176
-
Filesize
1KB
MD5a0ff51f24c8f2636e04b6143cb6bb605
SHA134fb946a36582cb758e5a6884e131fc04b16397a
SHA25600d610daad65358380ddc0e8bf8452b8ab63eafdd59a2b37154ce92016d1c402
SHA5121b4043a73869f4b9bdfa3068c32b66be163d50247e7264a98a97be885c36e0a4630594ab5dffcec302b8728850bf205b6acd9d37365a21e0705542acc6694fd5
-
C:\Users\Admin\AppData\Local\78c09df400ba7309548c26aa73a1ee26\Admin@CFZMTHEF_en-US\System\Process.txt
Filesize4KB
MD50cb1b94f6a35dddc4b35b9f198aa7e59
SHA1dc36fc08a8d31e9e7b6b8830a0fc2e0f466b6507
SHA256dcd3b2bc155effae6415c52f4e37c46e6ad665f63a1e372065d565539ba6fa8c
SHA512643c9216f3cf690b1e8dd57c8fa31bdcb438286ff7444b404af687925b6a1f849a5d3781a91943574c1e4b42e997e1bfac959840102d1e4fada1b865db4241b8
-
C:\Users\Admin\AppData\Local\78c09df400ba7309548c26aa73a1ee26\Admin@CFZMTHEF_en-US\System\ProductKey.txt
Filesize29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
-
Filesize
19B
MD575e5a3421bad6f4801b50d5d643567c3
SHA1a1d5400a9851d133a6a46a57fe786d818f5f8999
SHA2567e506d8e40b15bcbeac88ffdb26f147e1c0ea423f0e082ec77ce739006367fdf
SHA5124ffd5f4be4fb4a89978ca4deca640b6dc7bd7af3e7fccb2ee96558a588ef2149f9cd915f426eeafbbf04902a214c5fe5c25c6ccfab8a8838de06f8f26792e6c1