7232884fa26e8adade78a2da2f5fe45f3d5d21fa904acb12f0ecda78e0b0fbe5

General

Target

70642326a2a201e646770cc9381ccd2a.exe
Size

58KB
MD5

70642326a2a201e646770cc9381ccd2a
SHA1

7df304ea9930e9ecbf920747766a7d4b36e08273
SHA256

7232884fa26e8adade78a2da2f5fe45f3d5d21fa904acb12f0ecda78e0b0fbe5
SHA512

3935d782f46361cf3c978b4b5cf816398c09747316261bdfc2097fbd35f39d4611dbac64170d0d70596bb6e249306c3d2c629c01f52c412260c87ba4102cc326
SSDEEP

768:P0PFonppZMOaXDk0Tj6xP2R99zTb/Vegp+xZAj8rdBlQceElzUDNTiOQINmgC61C:fCOb0Tj6MR9BbkI+xZSudBjpOjQIoIYn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2772	fsg.exe
2724	pinch6.exe

Loads dropped DLL 10 IoCs

pid	Process
1516	70642326a2a201e646770cc9381ccd2a.exe
1516	70642326a2a201e646770cc9381ccd2a.exe
1516	70642326a2a201e646770cc9381ccd2a.exe
1516	70642326a2a201e646770cc9381ccd2a.exe
2772	fsg.exe
2772	fsg.exe
2772	fsg.exe
2772	fsg.exe
2772	fsg.exe
2772	fsg.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pinch6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c004346534616003100000000008f57eb78122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe8f57eb788f57eb782a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000042000000	fsg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	fsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a00310000000000375807a1102054656d700000360008000400efbe8f57eb78375807a12a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000008f570d7b10204c6f63616c00380008000400efbe8f57eb788f570d7b2a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	fsg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	fsg.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	fsg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	pinch6.exe
2724	pinch6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	fsg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	pinch6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	fsg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2772	1516	70642326a2a201e646770cc9381ccd2a.exe	28
PID 1516 wrote to memory of 2772	1516	70642326a2a201e646770cc9381ccd2a.exe	28
PID 1516 wrote to memory of 2772	1516	70642326a2a201e646770cc9381ccd2a.exe	28
PID 1516 wrote to memory of 2772	1516	70642326a2a201e646770cc9381ccd2a.exe	28
PID 1516 wrote to memory of 2724	1516	70642326a2a201e646770cc9381ccd2a.exe	29
PID 1516 wrote to memory of 2724	1516	70642326a2a201e646770cc9381ccd2a.exe	29
PID 1516 wrote to memory of 2724	1516	70642326a2a201e646770cc9381ccd2a.exe	29
PID 1516 wrote to memory of 2724	1516	70642326a2a201e646770cc9381ccd2a.exe	29

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pinch6.exe

C:\Users\Admin\AppData\Local\Temp\70642326a2a201e646770cc9381ccd2a.exe
"C:\Users\Admin\AppData\Local\Temp\70642326a2a201e646770cc9381ccd2a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\fsg.exe
  "C:\Users\Admin\AppData\Local\Temp\fsg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\pinch6.exe
  "C:\Users\Admin\AppData\Local\Temp\pinch6.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_win_path
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fsg.exe

Filesize
21KB

MD5
00bd8f44c6176394caf6c018c23ea71b

SHA1
bea81ea37908bead6bac9391891e234693fa1341

SHA256
7cd037fe5ef0d4531cb934b39570014718d2a60c01ab7a8cc74f466b6d0db417

SHA512
16810ec90f338eeabee9283fbe934f3b6b9cddb0161469bec644f61fce9ec63064820e9ed96fcacf6ec8683d1e6ff7c7b1fb700395a088b5a17243acdf236e02

Download Submit
\Users\Admin\AppData\Local\Temp\pinch6.exe

Filesize
29KB

MD5
84a6dad846d348759fa59c8b55e9d8f3

SHA1
593cad74dcbaef780d76c97bc5e3be96acbeea1d

SHA256
58883f9da6944e993bb39885e04137152cc7f510ed8c3e09b25bcd820bdcf675

SHA512
4af0cff7e950c86d9133b22ad12eca27a3ef05c256e28c762f83d1dae69323dfbd0c68e0e89ad9d20f2205cdf6a5743e07345eef5c6e0abf4471d828b26ef1e9

Download Submit
memory/2724-18-0x0000000013140000-0x000000001317D000-memory.dmp

Filesize
244KB

Download
memory/2724-19-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2724-33-0x0000000013140000-0x000000001317D000-memory.dmp

Filesize
244KB

Download
memory/2772-21-0x0000000004190000-0x0000000004192000-memory.dmp

Filesize
8KB

Download
memory/2772-20-0x0000000004180000-0x0000000004181000-memory.dmp

Filesize
4KB

Download
memory/2772-27-0x0000000013140000-0x000000001317D000-memory.dmp

Filesize
244KB

Download
memory/2772-31-0x0000000013140000-0x000000001317D000-memory.dmp

Filesize
244KB

Download
memory/2772-32-0x0000000013140000-0x000000001317D000-memory.dmp

Filesize
244KB

Download
memory/2772-34-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2772-36-0x0000000004180000-0x0000000004181000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing