7123566d71d2fd588fa4a408a7ef476b409d0e74929601c636f1fbc5b5854135

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2552-163-0x0000000000400000-0x0000000000472000-memory.exe
Size

456KB
MD5

8f7226104c4d7d8f2370189621507367
SHA1

dedb13ae4dec7788290a73162d7e63ef1e5cc7da
SHA256

7123566d71d2fd588fa4a408a7ef476b409d0e74929601c636f1fbc5b5854135
SHA512

9c819032d82e7c177be018a5eb2de7cd968fbc256577562f6523fdc07a546c35a0f415a4ab09b3266f1a47766ab1fc26a547f9679487eef853f52fd8ec1d6644
SSDEEP

12288:TWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmBC:0xgsRftD0C2nKGs

Score

6^/10

collection spyware

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3736 set thread context of 4516	3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	47	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4516	3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe	100
PID 3736 wrote to memory of 4516	3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe	100
PID 3736 wrote to memory of 4516	3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe	100
PID 3736 wrote to memory of 4516	3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe	100
PID 3736 wrote to memory of 4516	3736	2552-163-0x0000000000400000-0x0000000000472000-memory.exe	100

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\2552-163-0x0000000000400000-0x0000000000472000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2552-163-0x0000000000400000-0x0000000000472000-memory.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  - outlook_win_path
  PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4516-2-0x0000000000FA0000-0x0000000001006000-memory.dmp

Filesize
408KB

Download
memory/4516-3-0x0000000074270000-0x0000000074A20000-memory.dmp

Filesize
7.7MB

Download
memory/4516-4-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/4516-5-0x0000000005620000-0x00000000056DC000-memory.dmp

Filesize
752KB

Download
memory/4516-6-0x00000000057C0000-0x000000000585C000-memory.dmp

Filesize
624KB

Download
memory/4516-8-0x0000000074270000-0x0000000074A20000-memory.dmp

Filesize
7.7MB

Download