Analysis
-
max time kernel
143s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
16-02-2024 07:09
Static task
static1
Behavioral task
behavioral1
Sample
9fbfa26e891d310cf1c766834b76b1e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9fbfa26e891d310cf1c766834b76b1e3.exe
Resource
win10v2004-20231215-en
General
-
Target
9fbfa26e891d310cf1c766834b76b1e3.exe
-
Size
1.2MB
-
MD5
9fbfa26e891d310cf1c766834b76b1e3
-
SHA1
619af6bf696d00d8a5f50f320486e28a28736933
-
SHA256
c4f72c811a7b6f83b8cde40cbc757b3ed51eaea7c55edcc6f659389d011687fe
-
SHA512
6cd9e3ab966f1e86a715fbc53c9a4b1f950c9261643d56a92f00c88b665d653d25370c75332e9cd3271d903f0de6ae2f9b8753e8245de7fb606d6303bd4dfe22
-
SSDEEP
24576:Jrrna/Z+FPJYAocuxb8Jvb4DWBFAy4+ViNVhJHP:U/OBAt8Jv0DYFAyVoVhJHP
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
mail.yekamuhendislik.com - Port:
587 - Username:
muhasebe@yekamuhendislik.com - Password:
MuhasebE123*
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
BluStealer
A Modular information stealer written in Visual Basic.
-
A310logger Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger behavioral1/memory/2072-55-0x0000000000B80000-0x0000000000C32000-memory.dmp a310logger -
Executes dropped EXE 1 IoCs
Processes:
Fox.exepid process 2072 Fox.exe -
Loads dropped DLL 1 IoCs
Processes:
9fbfa26e891d310cf1c766834b76b1e3.exepid process 1888 9fbfa26e891d310cf1c766834b76b1e3.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9fbfa26e891d310cf1c766834b76b1e3.exedescription pid process target process PID 1320 set thread context of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9fbfa26e891d310cf1c766834b76b1e3.exedescription pid process Token: SeDebugPrivilege 1320 9fbfa26e891d310cf1c766834b76b1e3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9fbfa26e891d310cf1c766834b76b1e3.exepid process 1888 9fbfa26e891d310cf1c766834b76b1e3.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9fbfa26e891d310cf1c766834b76b1e3.exe9fbfa26e891d310cf1c766834b76b1e3.exedescription pid process target process PID 1320 wrote to memory of 2628 1320 9fbfa26e891d310cf1c766834b76b1e3.exe schtasks.exe PID 1320 wrote to memory of 2628 1320 9fbfa26e891d310cf1c766834b76b1e3.exe schtasks.exe PID 1320 wrote to memory of 2628 1320 9fbfa26e891d310cf1c766834b76b1e3.exe schtasks.exe PID 1320 wrote to memory of 2628 1320 9fbfa26e891d310cf1c766834b76b1e3.exe schtasks.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1320 wrote to memory of 1888 1320 9fbfa26e891d310cf1c766834b76b1e3.exe 9fbfa26e891d310cf1c766834b76b1e3.exe PID 1888 wrote to memory of 2072 1888 9fbfa26e891d310cf1c766834b76b1e3.exe Fox.exe PID 1888 wrote to memory of 2072 1888 9fbfa26e891d310cf1c766834b76b1e3.exe Fox.exe PID 1888 wrote to memory of 2072 1888 9fbfa26e891d310cf1c766834b76b1e3.exe Fox.exe PID 1888 wrote to memory of 2072 1888 9fbfa26e891d310cf1c766834b76b1e3.exe Fox.exe -
outlook_office_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
outlook_win_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fbfa26e891d310cf1c766834b76b1e3.exe"C:\Users\Admin\AppData\Local\Temp\9fbfa26e891d310cf1c766834b76b1e3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PZnirYwzu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD3C3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\9fbfa26e891d310cf1c766834b76b1e3.exe"C:\Users\Admin\AppData\Local\Temp\9fbfa26e891d310cf1c766834b76b1e3.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD3C3.tmpFilesize
1KB
MD54c257fcf05106ea3b7c1cb0a7fa03ba1
SHA17ec5212919d4030baf3fa92b449c9e4fd6597a12
SHA2566e81c4ef48cf02a7b2323245637b53006d7ac4457fad39701889dc7a605d0806
SHA512954e8007c052e15958c95efc5a416d2aea711b3f6c74b3924dc33154e2d2fd60502b998f231b2a107cb4dd5d4503c48f7b07afd475558371cb30a16ab30208cc
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\XGH67N~1.ZIPFilesize
285KB
MD540a9752d59f2883e40d928f85a749008
SHA1c60fb58eff64a7969b46f3934766f991352eeb47
SHA256ef95540ec8dae3d255439fb847d26397c265b5cccda5ed0d6b9ed3dda14a2820
SHA512ce33985f91103315accb1039635488d7e144df264bab8e164c1f9844ce6923e1c9c76349f14542901887ffcbbbca40b92cf474126f0b94893e8af1f608464b3c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeFilesize
689KB
MD591b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
memory/1320-24-0x0000000074420000-0x0000000074B0E000-memory.dmpFilesize
6.9MB
-
memory/1320-2-0x00000000047F0000-0x0000000004830000-memory.dmpFilesize
256KB
-
memory/1320-5-0x00000000047F0000-0x0000000004830000-memory.dmpFilesize
256KB
-
memory/1320-6-0x0000000005970000-0x0000000005A52000-memory.dmpFilesize
904KB
-
memory/1320-7-0x00000000053C0000-0x0000000005434000-memory.dmpFilesize
464KB
-
memory/1320-3-0x0000000000230000-0x0000000000248000-memory.dmpFilesize
96KB
-
memory/1320-1-0x0000000074420000-0x0000000074B0E000-memory.dmpFilesize
6.9MB
-
memory/1320-4-0x0000000074420000-0x0000000074B0E000-memory.dmpFilesize
6.9MB
-
memory/1320-0-0x0000000001220000-0x000000000135E000-memory.dmpFilesize
1.2MB
-
memory/1888-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1888-19-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1888-21-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1888-15-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1888-14-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1888-13-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1888-60-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2072-55-0x0000000000B80000-0x0000000000C32000-memory.dmpFilesize
712KB
-
memory/2072-56-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmpFilesize
9.9MB
-
memory/2072-57-0x000000001A790000-0x000000001A810000-memory.dmpFilesize
512KB
-
memory/2072-59-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmpFilesize
9.9MB