Analysis
-
max time kernel
134s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 16:01
Static task
static1
Behavioral task
behavioral1
Sample
a6c09767f7b9b02156bd3e4f67764e79.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a6c09767f7b9b02156bd3e4f67764e79.exe
Resource
win10v2004-20240221-en
General
-
Target
a6c09767f7b9b02156bd3e4f67764e79.exe
-
Size
922KB
-
MD5
a6c09767f7b9b02156bd3e4f67764e79
-
SHA1
5aa1d0515cd9ca1802c872cd8a9354b65cef7463
-
SHA256
2183dd8a07c328ff41cf8fedc06bdc9ec8166d6c11691cb6d379899318d8e555
-
SHA512
5f7072604303b4bea39a1c4751e09eb8399d9a10984ba2ddb699680145c952fb71d180e3e56135d30aa9639e9f5ff3899a3e58a2b7ab5d0ec38b88f94f17aa50
-
SSDEEP
24576:g831bHyqkkvaWB5DQaL+YFswDsd8U0Gdb:g83xjfa65DeYeCUr
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
mail.masarprecast.com - Port:
587 - Username:
info@masarprecast.com - Password:
Masar@Shj06
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
BluStealer
A Modular information stealer written in Visual Basic.
-
A310logger Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe a310logger behavioral1/memory/2232-58-0x0000000000130000-0x00000000001E2000-memory.dmp a310logger -
Executes dropped EXE 1 IoCs
Processes:
Fox.exepid process 2232 Fox.exe -
Loads dropped DLL 1 IoCs
Processes:
a6c09767f7b9b02156bd3e4f67764e79.exepid process 2460 a6c09767f7b9b02156bd3e4f67764e79.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a6c09767f7b9b02156bd3e4f67764e79.exedescription pid process target process PID 2860 set thread context of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a6c09767f7b9b02156bd3e4f67764e79.exepid process 2460 a6c09767f7b9b02156bd3e4f67764e79.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
a6c09767f7b9b02156bd3e4f67764e79.exea6c09767f7b9b02156bd3e4f67764e79.exedescription pid process target process PID 2860 wrote to memory of 2544 2860 a6c09767f7b9b02156bd3e4f67764e79.exe schtasks.exe PID 2860 wrote to memory of 2544 2860 a6c09767f7b9b02156bd3e4f67764e79.exe schtasks.exe PID 2860 wrote to memory of 2544 2860 a6c09767f7b9b02156bd3e4f67764e79.exe schtasks.exe PID 2860 wrote to memory of 2544 2860 a6c09767f7b9b02156bd3e4f67764e79.exe schtasks.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2860 wrote to memory of 2460 2860 a6c09767f7b9b02156bd3e4f67764e79.exe a6c09767f7b9b02156bd3e4f67764e79.exe PID 2460 wrote to memory of 2232 2460 a6c09767f7b9b02156bd3e4f67764e79.exe Fox.exe PID 2460 wrote to memory of 2232 2460 a6c09767f7b9b02156bd3e4f67764e79.exe Fox.exe PID 2460 wrote to memory of 2232 2460 a6c09767f7b9b02156bd3e4f67764e79.exe Fox.exe PID 2460 wrote to memory of 2232 2460 a6c09767f7b9b02156bd3e4f67764e79.exe Fox.exe -
outlook_office_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe -
outlook_win_path 1 IoCs
Processes:
Fox.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Fox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6c09767f7b9b02156bd3e4f67764e79.exe"C:\Users\Admin\AppData\Local\Temp\a6c09767f7b9b02156bd3e4f67764e79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LEjGKtEzH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF067.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a6c09767f7b9b02156bd3e4f67764e79.exe"C:\Users\Admin\AppData\Local\Temp\a6c09767f7b9b02156bd3e4f67764e79.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF067.tmpFilesize
1KB
MD55c2113e4547139e89037bec2423a69ec
SHA145d437a822c4d51408224a0aef06c5385a956ad0
SHA2569dc8a598f8171dbe51d2ae0180d0afc2cacd2161fee9fe04907af93d56babd07
SHA512cc32a8af821257c31faf5c5c1592013e4e0b795c23128fced6b6c8e4b4c79ab66809b4a50466cb3ca6e73aee694828a45015de5d5595a992e569d8b86f68900c
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\C5ILP3~1.ZIPFilesize
285KB
MD540a9752d59f2883e40d928f85a749008
SHA1c60fb58eff64a7969b46f3934766f991352eeb47
SHA256ef95540ec8dae3d255439fb847d26397c265b5cccda5ed0d6b9ed3dda14a2820
SHA512ce33985f91103315accb1039635488d7e144df264bab8e164c1f9844ce6923e1c9c76349f14542901887ffcbbbca40b92cf474126f0b94893e8af1f608464b3c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeFilesize
689KB
MD591b41651e6e9ab352805c6d35a297d08
SHA111b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
SHA2560872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
SHA512b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892
-
memory/2232-62-0x000007FEF5690000-0x000007FEF607C000-memory.dmpFilesize
9.9MB
-
memory/2232-60-0x000000001B310000-0x000000001B390000-memory.dmpFilesize
512KB
-
memory/2232-59-0x000007FEF5690000-0x000007FEF607C000-memory.dmpFilesize
9.9MB
-
memory/2232-58-0x0000000000130000-0x00000000001E2000-memory.dmpFilesize
712KB
-
memory/2460-24-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2460-22-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2460-13-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2460-15-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2460-16-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2460-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2860-25-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/2860-7-0x0000000000C60000-0x0000000000CC2000-memory.dmpFilesize
392KB
-
memory/2860-0-0x0000000001360000-0x000000000144C000-memory.dmpFilesize
944KB
-
memory/2860-6-0x00000000080D0000-0x000000000819E000-memory.dmpFilesize
824KB
-
memory/2860-5-0x0000000000700000-0x0000000000740000-memory.dmpFilesize
256KB
-
memory/2860-4-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/2860-3-0x0000000000600000-0x0000000000616000-memory.dmpFilesize
88KB
-
memory/2860-2-0x0000000000700000-0x0000000000740000-memory.dmpFilesize
256KB
-
memory/2860-1-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB