3c70b77b1f530155d8d69c2d13c8f5d44d3dc3e8c203cdd4996898ad3ccf8193

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2634233c62855cbc67bbd269e00fe9d.exe
Size

65KB
MD5

a2634233c62855cbc67bbd269e00fe9d
SHA1

b5238208924c594bb10111dce2f9fab40158dc24
SHA256

3c70b77b1f530155d8d69c2d13c8f5d44d3dc3e8c203cdd4996898ad3ccf8193
SHA512

9abc2029f90a835c50b1cd54fc733ce77f5e6cee1baea251cd204b00adbd2a19cff45611ca648adbf19b2aef3205412fa24cc6dfa8464aba08c968ce94a61eb8
SSDEEP

768:yAWcdiE5zCt4aVkeqru18JBSTAooVNgIJEs1v61iWlzxVpt0nbKVDuk1wFi:ynoCt4EqTSsJE06DxV8GVDufY

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
752	43153a2634233c62855cbc67bbd269e00fe9d.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	43153a2634233c62855cbc67bbd269e00fe9d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
752	43153a2634233c62855cbc67bbd269e00fe9d.exe
752	43153a2634233c62855cbc67bbd269e00fe9d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	43153a2634233c62855cbc67bbd269e00fe9d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3092	a2634233c62855cbc67bbd269e00fe9d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 752	3092	a2634233c62855cbc67bbd269e00fe9d.exe	85
PID 3092 wrote to memory of 752	3092	a2634233c62855cbc67bbd269e00fe9d.exe	85
PID 3092 wrote to memory of 752	3092	a2634233c62855cbc67bbd269e00fe9d.exe	85

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	43153a2634233c62855cbc67bbd269e00fe9d.exe

C:\Users\Admin\AppData\Local\Temp\a2634233c62855cbc67bbd269e00fe9d.exe
"C:\Users\Admin\AppData\Local\Temp\a2634233c62855cbc67bbd269e00fe9d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\43153a2634233c62855cbc67bbd269e00fe9d.exe
  C:\Users\Admin\AppData\Local\Temp\43153a2634233c62855cbc67bbd269e00fe9d.exe
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_win_path
  PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\43153a2634233c62855cbc67bbd269e00fe9d.exe

Filesize
41KB

MD5
dceb9de0ebfd62d7fceddb4add614f65

SHA1
f6ee90a810362d57c3b785b4fa49db7f03554723

SHA256
34717f9671fa81488ab9f99c5af81c14f65e9b8ea703621f0e7863a94b909fb5

SHA512
00a5add9c20dbd80d480bf66200536f1cb47474b5620c05c4c1cc4e9194bca5b0992a813642eee8cb99ae4a480ca351234ab46abefcf5bc98e254368bc060cb5

Download Submit
memory/752-5-0x0000000013140000-0x0000000013178000-memory.dmp

Filesize
224KB

Download
memory/752-7-0x0000000013140000-0x0000000013178000-memory.dmp

Filesize
224KB

Download