964d04c3eee6b5e212d77cddedcb75532df53bd8f3fb670c2f5d3e74f6ca1dde

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c718f89bd0170f041f58247db3084f17.exe
Size

781KB
MD5

c718f89bd0170f041f58247db3084f17
SHA1

4adadd6f92ee22d65fd9347cc7795cb843ff2390
SHA256

964d04c3eee6b5e212d77cddedcb75532df53bd8f3fb670c2f5d3e74f6ca1dde
SHA512

623d395b1e1ae58f287b07a1c165a383ae01ce8c5ca33d41d853951a94b6657bd5f1c71cc85ed2773da9f3d5a05bc4eb34c9d71c71224fbd6797ee1c8c428af0
SSDEEP

24576:KIluRcB8Co7WulLmBaFYK0mVyNLxXnWg3wHj3FW81iiiii:blujhlgaVAXnjsj4Qiiiii

Score

7^/10

collection persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2780	14448.exe
2776	13174.exe
2996	Update.exe

Loads dropped DLL 4 IoCs

pid	Process
2780	14448.exe
2996	Update.exe
2996	Update.exe
2996	Update.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000130fc-7.dat	upx
behavioral1/memory/2780-11-0x0000000000400000-0x00000000005C4000-memory.dmp	upx
behavioral1/memory/2780-26-0x0000000000400000-0x00000000005C4000-memory.dmp	upx
behavioral1/memory/2996-35-0x0000000000400000-0x00000000005C4000-memory.dmp	upx
behavioral1/memory/2780-34-0x0000000000400000-0x00000000005C4000-memory.dmp	upx
behavioral1/memory/2780-31-0x0000000003170000-0x0000000003334000-memory.dmp	upx
behavioral1/memory/2996-57-0x0000000010000000-0x000000001005A000-memory.dmp	upx
behavioral1/memory/2996-56-0x0000000010000000-0x000000001005A000-memory.dmp	upx
behavioral1/memory/2996-61-0x0000000000400000-0x00000000005C4000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Update.exe\""	WScript.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\icq\shared folder\	Update.exe
File created	C:\Program Files (x86)\limewire\shared\	Update.exe
File created	C:\Program Files (x86)\morpheus\my shared folder\	Update.exe
File created	C:\Program Files (x86)\tesla\files\	Update.exe
File created	C:\Program Files (x86)\winmx\shared\	Update.exe
File created	C:\Program Files (x86)\bearshare\shared\	Update.exe
File created	C:\Program Files (x86)\edonkey2000\incoming\	Update.exe
File created	C:\Program Files (x86)\grokster\my grokster\	Update.exe
File created	C:\Program Files (x86)\kazaa\my shared folder\	Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	Update.exe
2996	Update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	300	c718f89bd0170f041f58247db3084f17.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 2780	300	c718f89bd0170f041f58247db3084f17.exe	28
PID 300 wrote to memory of 2780	300	c718f89bd0170f041f58247db3084f17.exe	28
PID 300 wrote to memory of 2780	300	c718f89bd0170f041f58247db3084f17.exe	28
PID 300 wrote to memory of 2780	300	c718f89bd0170f041f58247db3084f17.exe	28
PID 300 wrote to memory of 2776	300	c718f89bd0170f041f58247db3084f17.exe	29
PID 300 wrote to memory of 2776	300	c718f89bd0170f041f58247db3084f17.exe	29
PID 300 wrote to memory of 2776	300	c718f89bd0170f041f58247db3084f17.exe	29
PID 300 wrote to memory of 2776	300	c718f89bd0170f041f58247db3084f17.exe	29
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2780 wrote to memory of 2996	2780	14448.exe	30
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2656	2996	Update.exe	31
PID 2996 wrote to memory of 2484	2996	Update.exe	32
PID 2996 wrote to memory of 2484	2996	Update.exe	32
PID 2996 wrote to memory of 2484	2996	Update.exe	32
PID 2996 wrote to memory of 2484	2996	Update.exe	32
PID 2996 wrote to memory of 2484	2996	Update.exe	32
PID 2996 wrote to memory of 2484	2996	Update.exe	32
PID 2996 wrote to memory of 2484	2996	Update.exe	32

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Update.exe

C:\Users\Admin\AppData\Local\Temp\c718f89bd0170f041f58247db3084f17.exe
"C:\Users\Admin\AppData\Local\Temp\c718f89bd0170f041f58247db3084f17.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300
- C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\14448.exe
  "C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\14448.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Update.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Update.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - outlook_win_path
    PID:2996
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Autorun.vbs"
      4⤵
      Adds Run key to start application
      PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\Host.bat" "
      4⤵
      PID:2484
- C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\13174.exe
  "C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\13174.exe"
  2⤵
  - Executes dropped EXE
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Autorun.vbs

Filesize
247B

MD5
af2aa503da2af83c7159237177b6e6c3

SHA1
4f367aeb93e7ed2e182ab3dbecd362c6d5bbbdc0

SHA256
1bae860ca2dc2337e568887cd6ade377ce370328010ab57cb658da2751af6cd7

SHA512
9a6e65fb01ab810d98f9453f159cc47935b72b6afc56c32383512c026ec3932431af3abdbe0ba09fe509651b880ed4368ea879190b4c502cb39c42e5281fe3a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Host.bat

Filesize
79B

MD5
b68c71cd61fe63e07635efb95c276ed7

SHA1
65ff08d858b7c2901aea0c0f6e515d61899a031b

SHA256
114605c4aaa78610032e1f2cdbe7638495a53d292e998dbeaae1294f47e7b4d3

SHA512
4dffba6d34bca8e508202a13aec069eb5320538ccfe1600ebc65817a953930f6cdd8d8512e259f1e7ebf4dccf32e30d08b4faf776a74c1a22741de9541d15e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\13174.exe

Filesize
143KB

MD5
da962d71508a14ebd5528b5f8fa309b7

SHA1
980814ed6472b5650516ba6d2b2355a77f5b5bbe

SHA256
9c9467b710cf46dcdd567b0ebd48f45c05ce902bd09444e2ba29feaa9c9a5f5f

SHA512
ad77725e7bc2d6146252c1560172a2756029c7f4bcc571cb6cebacba5f173c93985d034702210027807cae6c0b84732b1058d24645f5e4398fabed3dfaacf209

Download Submit
C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\14448.exe

Filesize
630KB

MD5
aee245cf97c37a7a3944e9fd77b8e74d

SHA1
14ce8480fe446872b90a0b8b9d17038df25f4763

SHA256
63f1fbbe3b334b82ffd19644020361f3a5b50b1fa77a448cb8268c89e8febafa

SHA512
67d4643580a46d9b644b14e0c2948c4a1f4b1f0dc113e405dc3da69f63fd928cbf75a550ccc9b0b40b3ccb45b6d71a6154cb222f3cdbce5eaeb39ffce38a81c6

Download Submit
memory/300-2-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/300-4-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/300-21-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/300-3-0x0000000002130000-0x00000000021B0000-memory.dmp

Filesize
512KB

Download
memory/2776-60-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2776-20-0x0000000000AE0000-0x0000000000B0C000-memory.dmp

Filesize
176KB

Download
memory/2776-22-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/2776-23-0x0000000004780000-0x00000000047C0000-memory.dmp

Filesize
256KB

Download
memory/2776-24-0x0000000004780000-0x00000000047C0000-memory.dmp

Filesize
256KB

Download
memory/2776-25-0x0000000004780000-0x00000000047C0000-memory.dmp

Filesize
256KB

Download
memory/2780-16-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2780-34-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2780-31-0x0000000003170000-0x0000000003334000-memory.dmp

Filesize
1.8MB

Download
memory/2780-26-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2780-11-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2996-39-0x0000000000B60000-0x0000000000D24000-memory.dmp

Filesize
1.8MB

Download
memory/2996-41-0x0000000000B60000-0x0000000000D24000-memory.dmp

Filesize
1.8MB

Download
memory/2996-43-0x0000000000B60000-0x0000000000D24000-memory.dmp

Filesize
1.8MB

Download
memory/2996-35-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2996-57-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2996-56-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2996-61-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download