e5c80844063be3cea01fa549f22c23723909ce5e596e2f9001b8c37099657210

Analysis

max time kernel
37s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2024 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5c80844.exe
Size

2.6MB
MD5

b69036a695b48549380a64c8df3a00f1
SHA1

1f70d2f6e9b3172291fba309d60adea856af6be0
SHA256

e5c80844063be3cea01fa549f22c23723909ce5e596e2f9001b8c37099657210
SHA512

4d5c763842c556eca464cb6aceb3cb6b68ed16794f159c06f28873f32580ee977cef9e9697b92b2f3b1c1d72592f03460b53964ff5d2593a05b7f6a7aafd9cf3
SSDEEP

49152:9xVm0KsjOgkwuEfD9GqLToTy1No2IiXwKYIBEe6k:J1S0TooVXXxqBk

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 api.ipify.org
15 api.ipify.org

flow	ioc
13	api.ipify.org
15	api.ipify.org

Modifies registry class 2 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e5c80844.exe

pid process

3872 e5c80844.exe
3492
3492
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3492
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e5c80844.exe

pid process

3872 e5c80844.exe

pid	process
3872	e5c80844.exe
3492
3492

pid	process
3492

pid	process
3872	e5c80844.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492

outlook_office_path 1 IoCs

Processes:

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

outlook_win_path 1 IoCs

Processes:

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

C:\Users\Admin\AppData\Local\Temp\e5c80844.exe
"C:\Users\Admin\AppData\Local\Temp\e5c80844.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-0-0x00000000030F0000-0x000000000314E000-memory.dmp

Filesize
376KB

Download