Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
14/02/2024, 09:10
General
- Target allegato_362.js
- Size 5KB
- Sample240214-k5b3gaee2v
- SHA256 c937e93e8352b27b126c1593cc456e5d82b9371b87a45636e29ed34a43dddadb
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\allegato_362.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" /B C:\Users\Admin\AppData\Local\Temp\Obdwdttejy.dll,start2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" /B C:\Users\Admin\AppData\Local\Temp\Obdwdttejy.dll,start3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Obdwdttejy.dll
Qiuwfhoatspthr
Wweytdpr
__PSScriptPolicyTest_nvg0xugo.ecw.ps1
memory/228-14-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-6-0x00000000047E0000-0x0000000005671000-memory.dmp
memory/228-9-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-10-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-11-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-13-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-7-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-12-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-15-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-8-0x0000000077CC2000-0x0000000077CC3000-memory.dmp
memory/228-5-0x0000000074BC0000-0x0000000075726000-memory.dmp
memory/228-41-0x0000000074BC0000-0x0000000075726000-memory.dmp
memory/228-57-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-59-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-103-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-90-0x0000000005680000-0x0000000005E82000-memory.dmp
memory/228-4-0x0000000074BC0000-0x0000000075726000-memory.dmp
memory/2632-62-0x0000000004C40000-0x0000000004C62000-memory.dmp
memory/2632-63-0x0000000005550000-0x00000000055B6000-memory.dmp
memory/2632-73-0x0000000004DB0000-0x0000000004E16000-memory.dmp
memory/2632-74-0x0000000005710000-0x0000000005A64000-memory.dmp
memory/2632-75-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
memory/2632-76-0x0000000005C40000-0x0000000005C8C000-memory.dmp
memory/2632-78-0x000000006D890000-0x000000006D8DC000-memory.dmp
memory/2632-77-0x0000000006BC0000-0x0000000006BF2000-memory.dmp
memory/2632-88-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/2632-89-0x0000000006C00000-0x0000000006CA3000-memory.dmp
memory/2632-61-0x0000000004E20000-0x0000000005448000-memory.dmp
memory/2632-91-0x0000000007560000-0x0000000007BDA000-memory.dmp
memory/2632-92-0x0000000006F20000-0x0000000006F3A000-memory.dmp
memory/2632-93-0x0000000006F90000-0x0000000006F9A000-memory.dmp
memory/2632-94-0x00000000071A0000-0x0000000007236000-memory.dmp
memory/2632-95-0x0000000007120000-0x0000000007131000-memory.dmp
memory/2632-96-0x0000000007150000-0x000000000715E000-memory.dmp
memory/2632-97-0x0000000007160000-0x0000000007174000-memory.dmp
memory/2632-98-0x0000000007260000-0x000000000727A000-memory.dmp
memory/2632-99-0x0000000007240000-0x0000000007248000-memory.dmp
memory/2632-60-0x0000000002320000-0x0000000002356000-memory.dmp