Analysis
-
max time kernel
135s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-01-2024 04:29
Static task
static1
Behavioral task
behavioral1
Sample
6c59f6d8524d9cbfb92e4937ce941503.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6c59f6d8524d9cbfb92e4937ce941503.exe
Resource
win10v2004-20231215-en
General
-
Target
6c59f6d8524d9cbfb92e4937ce941503.exe
-
Size
878KB
-
MD5
6c59f6d8524d9cbfb92e4937ce941503
-
SHA1
15257449da787af10c0800074fcf9c8c5f094057
-
SHA256
237f6d600f9ecbd9e8d7f2091ea45734f9204b90c2c10b2837bc82b9fbe89e33
-
SHA512
009d19406beeab9b5b1ea892e0e718e0940aed96dd7c5ec35dbd494facf61eea95df9b8b11d7108e136900f802e759129b10af5e945a3fac51ad47df834ec98a
-
SSDEEP
12288:IeZhPmY3tK2gs2hFQdALegUcRfVZEgDup/eenfS+jdi0ROh:IF9H5jQdGegfRfVRSdeafXjdrRm
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
mail.yekamuhendislik.com - Port:
587 - Username:
muhasebe@yekamuhendislik.com - Password:
MuhasebE123*
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
BluStealer
A Modular information stealer written in Visual Basic.
-
A310logger Executable 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger behavioral1/memory/2808-55-0x0000000000A70000-0x0000000000B22000-memory.dmp a310logger -
Executes dropped EXE 1 IoCs
Processes:
Fox.exepid process 2808 Fox.exe -
Loads dropped DLL 1 IoCs
Processes:
6c59f6d8524d9cbfb92e4937ce941503.exepid process 2632 6c59f6d8524d9cbfb92e4937ce941503.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6c59f6d8524d9cbfb92e4937ce941503.exedescription pid process target process PID 2928 set thread context of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6c59f6d8524d9cbfb92e4937ce941503.exepid process 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 2928 6c59f6d8524d9cbfb92e4937ce941503.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6c59f6d8524d9cbfb92e4937ce941503.exedescription pid process Token: SeDebugPrivilege 2928 6c59f6d8524d9cbfb92e4937ce941503.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6c59f6d8524d9cbfb92e4937ce941503.exepid process 2632 6c59f6d8524d9cbfb92e4937ce941503.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6c59f6d8524d9cbfb92e4937ce941503.exe6c59f6d8524d9cbfb92e4937ce941503.exedescription pid process target process PID 2928 wrote to memory of 3000 2928 6c59f6d8524d9cbfb92e4937ce941503.exe schtasks.exe PID 2928 wrote to memory of 3000 2928 6c59f6d8524d9cbfb92e4937ce941503.exe schtasks.exe PID 2928 wrote to memory of 3000 2928 6c59f6d8524d9cbfb92e4937ce941503.exe schtasks.exe PID 2928 wrote to memory of 3000 2928 6c59f6d8524d9cbfb92e4937ce941503.exe schtasks.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2928 wrote to memory of 2632 2928 6c59f6d8524d9cbfb92e4937ce941503.exe 6c59f6d8524d9cbfb92e4937ce941503.exe PID 2632 wrote to memory of 2808 2632 6c59f6d8524d9cbfb92e4937ce941503.exe Fox.exe PID 2632 wrote to memory of 2808 2632 6c59f6d8524d9cbfb92e4937ce941503.exe Fox.exe PID 2632 wrote to memory of 2808 2632 6c59f6d8524d9cbfb92e4937ce941503.exe Fox.exe PID 2632 wrote to memory of 2808 2632 6c59f6d8524d9cbfb92e4937ce941503.exe Fox.exe -
outlook_office_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
outlook_win_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c59f6d8524d9cbfb92e4937ce941503.exe"C:\Users\Admin\AppData\Local\Temp\6c59f6d8524d9cbfb92e4937ce941503.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TjWPgbKZz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB8F3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\6c59f6d8524d9cbfb92e4937ce941503.exe"C:\Users\Admin\AppData\Local\Temp\6c59f6d8524d9cbfb92e4937ce941503.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\TQOARG~1.ZIPFilesize
285KB
MD540a9752d59f2883e40d928f85a749008
SHA1c60fb58eff64a7969b46f3934766f991352eeb47
SHA256ef95540ec8dae3d255439fb847d26397c265b5cccda5ed0d6b9ed3dda14a2820
SHA512ce33985f91103315accb1039635488d7e144df264bab8e164c1f9844ce6923e1c9c76349f14542901887ffcbbbca40b92cf474126f0b94893e8af1f608464b3c
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeFilesize
689KB
MD591b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
memory/2632-15-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2632-22-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2632-60-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2632-13-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2632-14-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2632-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2632-19-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2808-59-0x000007FEF6000000-0x000007FEF69EC000-memory.dmpFilesize
9.9MB
-
memory/2808-57-0x000000001B060000-0x000000001B0E0000-memory.dmpFilesize
512KB
-
memory/2808-56-0x000007FEF6000000-0x000007FEF69EC000-memory.dmpFilesize
9.9MB
-
memory/2808-55-0x0000000000A70000-0x0000000000B22000-memory.dmpFilesize
712KB
-
memory/2928-7-0x0000000005670000-0x00000000056CC000-memory.dmpFilesize
368KB
-
memory/2928-21-0x0000000074E60000-0x000000007554E000-memory.dmpFilesize
6.9MB
-
memory/2928-2-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2928-1-0x0000000074E60000-0x000000007554E000-memory.dmpFilesize
6.9MB
-
memory/2928-0-0x0000000000A30000-0x0000000000B12000-memory.dmpFilesize
904KB
-
memory/2928-3-0x0000000000540000-0x000000000055C000-memory.dmpFilesize
112KB
-
memory/2928-6-0x00000000055E0000-0x0000000005672000-memory.dmpFilesize
584KB
-
memory/2928-5-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2928-4-0x0000000074E60000-0x000000007554E000-memory.dmpFilesize
6.9MB