3b8bf4df71917350d38daf2b4a17b68b05e1d9fa8e327b21b83275fe5dffd0be

Analysis

max time kernel
129s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64a80359bff8a5e94be61f23c125903b.exe
Size 256KB
Sample240118-grflyseeh5
SHA256 3b8bf4df71917350d38daf2b4a17b68b05e1d9fa8e327b21b83275fe5dffd0be
MD5 64a80359bff8a5e94be61f23c125903b
SHA1 99eb53bcba202cfd17b6faf9eccb27eb77cff81a
SHA512 2936025e4ec05210a61551be6e1a891c291dff70bfb71d68502e4963e2fbbb0c789b7fe35ef52ecb7654c35f80d7c45aa2162f9b7a0d7bb0731d9d943430f97e
SSDEEP 6144:oawa9mjimYaQLHrhaYaQuWwkU/YoYaQLHrhaYaQ:oawRXY2YVJUbY2Y
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4368	outlook.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\sys32.exe"	64a80359bff8a5e94be61f23c125903b.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sys32.exe	64a80359bff8a5e94be61f23c125903b.exe
File opened for modification	C:\Windows\outlook.cfg	outlook.exe
File created	C:\Windows\crc32.cfg	outlook.exe
File created	C:\Windows\sys32.exe	64a80359bff8a5e94be61f23c125903b.exe
File created	C:\Windows\outlook.exe	64a80359bff8a5e94be61f23c125903b.exe
File opened for modification	C:\Windows\outlook.exe	64a80359bff8a5e94be61f23c125903b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5024	4368	WerFault.exe	69

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4368	1492	64a80359bff8a5e94be61f23c125903b.exe	69
PID 1492 wrote to memory of 4368	1492	64a80359bff8a5e94be61f23c125903b.exe	69
PID 1492 wrote to memory of 4368	1492	64a80359bff8a5e94be61f23c125903b.exe	69

C:\Users\Admin\AppData\Local\Temp\64a80359bff8a5e94be61f23c125903b.exe
"C:\Users\Admin\AppData\Local\Temp\64a80359bff8a5e94be61f23c125903b.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\outlook.exe
  C:\Windows\outlook.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 29816
    3⤵
    - Program crash
    PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4368 -ip 4368
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

outlook.cfg

Path C:\Windows\outlook.cfg
Size 2KB
SHA256 3c6a506527545f07d270b5bc3b4394a9b20b690a56d95d6b45299bb35d6b5773
MD5 e7f05826ac1d5ee4c1ed937b2b1df5da
SHA1 9d3b705d45320b97175507e707868a8766563c0c
SHA512 5a7b193486a7b55c6d54a38f4fe330d1c1b5c3b01746e4171ba1facc095e49321dec5f782691a014b8b1970edf2decd48e5291d2d46e8fecaec5309f158c498a
MD5 SHA1 SHA512

Submit Download

outlook.cfg

Path C:\Windows\outlook.cfg
Size 684B
SHA256 8cf8dac4cb0fc69b6b7b38fdde054b7028a21a24df69b03fd6f3ec8b65f3f7d8
MD5 a7fcb69d3ab6306442ab6a8799deb4d0
SHA1 2a09b7a3b14316afd077713a915cc4400b7aae5c
SHA512 32160721a6d72091f9bfb15151fb710c6323c189d921fa11fdd726801a8a314c5b70dc57e18d9a798e3d1b60e138985fc64004f2030ba65b97297728c9e4b001
MD5 SHA1 SHA512

Submit Download

outlook.cfg

Path C:\Windows\outlook.cfg
Size 1KB
SHA256 6201dc017497d4449f27c90f735e39fa722c4d20ef87cc7dd0e5889fa940ed84
MD5 bf2a61a4cb762926c76f30e217b60d33
SHA1 fdaa553112f629aba37cca387118d4e752a4aee0
SHA512 20053c09febf64dce536712c80b6ec74d0fffbd4feef9c84870290f10cdb66365b95445be134979665e2885453dd8c7327e56e0edc8b12a09e6fc2148b56c09a
MD5 SHA1 SHA512

Submit Download

outlook.cfg

Path C:\Windows\outlook.cfg
Size 1KB
SHA256 b6b0139fd9f05ffe2373101933bc6a063f4972dde31a798782e86766837a3bbf
MD5 7f7f6b186f77f5f3aab326842794d8c8
SHA1 e3f9de1084621bb7f2e650784ebdf1b9d951f822
SHA512 72c14a11887bee186ea55c5511d36dd73feac979c019184d8a58d17e63779afe01c3c0f9512e9a653e82d2e34f9b638be13882c211358d5b5d0c25dd245b9490
MD5 SHA1 SHA512

Submit Download

outlook.exe

Path C:\Windows\outlook.exe
Size 49KB
SHA256 96b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28
MD5 0e9379e357aba95f8b9883af9b67675e
SHA1 280a174a414e5b8588f42b6328af2c8c8ff4394f
SHA512 6cc383806882729cd889b025802ac0d5e1c55a74b3e7d7c98932644e8802fe52b5b14a886eff70ab7deaa70fb60bb9898e55b5cd83b5b99e2a2d107dce367784
SSDEEP 768:YtpL9eEj+w9vvidJyZJDe4dqEk0PiXSe0mxMr68eVniVUCosm/mzT1fHyVQh2e:FOZ9vQqDe4dPkjpBV8eVniVHm0dl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1492-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1492-18-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4368-116-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4368-118-0x0000000000400000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads