outsteel | 0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e

Analysis

max time kernel
163s
max time network
182s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
Size

779KB
MD5

bf54e0c0740b6f0baf357153ab96d965
SHA1

6f53badd55841d225d6c6235aa45134a48e70954
SHA256

0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e
SHA512

f3be135f9682774a8e7d0c788b22bc2a3a57281c9b46c9d26083425575db33a1888673b78a13b07beed6c5645c54c7f2067c2483ec622339f048f4d46b4c726c
SSDEEP

12288:hdH3aW/CKuDuoEdv40VtsFfN0p8JTkn3JNFr5beFbWz4OK:hF3aDAvFsFfNpWn3J5eFbWzBK

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe

description	ioc	Process
File opened (read-only)	\??\h:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\i:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\j:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\n:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\o:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\t:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\v:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\g:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\z:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\y:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\r:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\u:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\e:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\q:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\x:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\m:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\b:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\k:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\l:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\p:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\s:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\w:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
File opened (read-only)	\??\a:	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2504-2-0x0000000001DA0000-0x0000000001E7D000-memory.dmp	autoit_exe
behavioral1/memory/2504-3-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-4-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-7-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-8-0x0000000001DA0000-0x0000000001E7D000-memory.dmp	autoit_exe
behavioral1/memory/2504-10-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-12-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-14-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-16-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-18-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/2504-20-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe

description	pid	Process	procid_target
PID 2504 wrote to memory of 2536	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	28
PID 2504 wrote to memory of 2536	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	28
PID 2504 wrote to memory of 2536	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	28
PID 2504 wrote to memory of 2536	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	28
PID 2504 wrote to memory of 2860	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	31
PID 2504 wrote to memory of 2860	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	31
PID 2504 wrote to memory of 2860	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	31
PID 2504 wrote to memory of 2860	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	31
PID 2504 wrote to memory of 2576	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	33
PID 2504 wrote to memory of 2576	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	33
PID 2504 wrote to memory of 2576	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	33
PID 2504 wrote to memory of 2576	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	33
PID 2504 wrote to memory of 2408	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	35
PID 2504 wrote to memory of 2408	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	35
PID 2504 wrote to memory of 2408	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	35
PID 2504 wrote to memory of 2408	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	35
PID 2504 wrote to memory of 2468	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	37
PID 2504 wrote to memory of 2468	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	37
PID 2504 wrote to memory of 2468	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	37
PID 2504 wrote to memory of 2468	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	37
PID 2504 wrote to memory of 3056	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	39
PID 2504 wrote to memory of 3056	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	39
PID 2504 wrote to memory of 3056	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	39
PID 2504 wrote to memory of 3056	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	39
PID 2504 wrote to memory of 2696	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	41
PID 2504 wrote to memory of 2696	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	41
PID 2504 wrote to memory of 2696	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	41
PID 2504 wrote to memory of 2696	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	41
PID 2504 wrote to memory of 476	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	43
PID 2504 wrote to memory of 476	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	43
PID 2504 wrote to memory of 476	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	43
PID 2504 wrote to memory of 476	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	43
PID 2504 wrote to memory of 2944	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	45
PID 2504 wrote to memory of 2944	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	45
PID 2504 wrote to memory of 2944	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	45
PID 2504 wrote to memory of 2944	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	45
PID 2504 wrote to memory of 2948	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	47
PID 2504 wrote to memory of 2948	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	47
PID 2504 wrote to memory of 2948	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	47
PID 2504 wrote to memory of 2948	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	47
PID 2504 wrote to memory of 2076	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	49
PID 2504 wrote to memory of 2076	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	49
PID 2504 wrote to memory of 2076	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	49
PID 2504 wrote to memory of 2076	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	49
PID 2504 wrote to memory of 1472	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	51
PID 2504 wrote to memory of 1472	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	51
PID 2504 wrote to memory of 1472	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	51
PID 2504 wrote to memory of 1472	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	51
PID 2504 wrote to memory of 2816	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	53
PID 2504 wrote to memory of 2816	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	53
PID 2504 wrote to memory of 2816	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	53
PID 2504 wrote to memory of 2816	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	53
PID 2504 wrote to memory of 2764	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	55
PID 2504 wrote to memory of 2764	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	55
PID 2504 wrote to memory of 2764	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	55
PID 2504 wrote to memory of 2764	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	55
PID 2504 wrote to memory of 1528	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	57
PID 2504 wrote to memory of 1528	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	57
PID 2504 wrote to memory of 1528	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	57
PID 2504 wrote to memory of 1528	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	57
PID 2504 wrote to memory of 564	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	59
PID 2504 wrote to memory of 564	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	59
PID 2504 wrote to memory of 564	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	59
PID 2504 wrote to memory of 564	2504	0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe	59

C:\Users\Admin\AppData\Local\Temp\0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe
"C:\Users\Admin\AppData\Local\Temp\0f19735f076a42396b9f41b10c314d094a54e0e647f2cf7a2c025da8f8e9f54e.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-1-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2504-2-0x0000000001DA0000-0x0000000001E7D000-memory.dmp

Filesize
884KB

Download
memory/2504-3-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-4-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-6-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2504-7-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-8-0x0000000001DA0000-0x0000000001E7D000-memory.dmp

Filesize
884KB

Download
memory/2504-10-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-12-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-14-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-16-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-18-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2504-20-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download