outsteel | 187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa

General

Target

187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
Size

649KB
MD5

a7eb8d7b83e5fd622c1e205c911a110a
SHA1

c685312922a40d841e583f9399f66d35d6ccfb46
SHA256

187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa
SHA512

74491263adde3ff2eaa49394155e31d5b693bf1534d926580e804ad92f314801c696a2cdf0645c957ba666352dea21a2a97aaa0144866f95f1cf85a85d836980
SSDEEP

12288:utr6/CnX8yXPD3N1tH1epcuSdCusLqqcYourJqeK2xGn:uUSjXPD3N1y9SsJqrur8ezGn

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe

description	ioc	process
File opened (read-only)	\??\e:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\p:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\q:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\s:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\t:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\i:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\k:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\o:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\u:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\x:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\z:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\a:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\j:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\l:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\m:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\v:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\w:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\b:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\g:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\h:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\n:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\r:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
File opened (read-only)	\??\y:	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/3496-2-0x0000000005BE0000-0x0000000005CBD000-memory.dmp	autoit_exe
behavioral2/memory/3496-3-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe
behavioral2/memory/3496-6-0x0000000005BE0000-0x0000000005CBD000-memory.dmp	autoit_exe
behavioral2/memory/3496-7-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe
behavioral2/memory/3496-9-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe
behavioral2/memory/3496-11-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe
behavioral2/memory/3496-13-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe
behavioral2/memory/3496-15-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe
behavioral2/memory/3496-18-0x0000000000400000-0x0000000003E04000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe

description	pid	process	target process
PID 3496 wrote to memory of 4164	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4164	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4164	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3376	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3376	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3376	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 1568	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 1568	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 1568	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 5032	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 5032	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 5032	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4336	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4336	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4336	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3756	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3756	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3756	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4132	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4132	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4132	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2128	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2128	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2128	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 5096	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 5096	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 5096	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2964	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2964	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2964	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4756	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4756	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4756	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3672	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3672	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 3672	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2968	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2968	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2968	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4240	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4240	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 4240	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2696	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2696	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2696	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2436	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2436	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 2436	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 844	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 844	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe
PID 3496 wrote to memory of 844	3496	187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe
"C:\Users\Admin\AppData\Local\Temp\187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3496-1-0x0000000003EF0000-0x0000000003FF0000-memory.dmp

Filesize
1024KB

Download
memory/3496-2-0x0000000005BE0000-0x0000000005CBD000-memory.dmp

Filesize
884KB

Download
memory/3496-3-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download
memory/3496-5-0x0000000003EF0000-0x0000000003FF0000-memory.dmp

Filesize
1024KB

Download
memory/3496-6-0x0000000005BE0000-0x0000000005CBD000-memory.dmp

Filesize
884KB

Download
memory/3496-7-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download
memory/3496-9-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download
memory/3496-11-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download
memory/3496-13-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download
memory/3496-15-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download
memory/3496-18-0x0000000000400000-0x0000000003E04000-memory.dmp

Filesize
58.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads