Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 11:03

General

  • Target

    56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe

  • Size

    697KB

  • MD5

    a31cb445d3131bf567720c43f2a74484

  • SHA1

    29e763a59424f9bb147df11a7b2ebfe9373a451f

  • SHA256

    56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256

  • SHA512

    ca8d1c63ababcb662922d4e91c3f599579ce324881ca4ce6effe942b91037012fc959060eab730d62b07330c17bd4ac49458b52c224c5e615ee55ae469ae0ae0

  • SSDEEP

    12288:4ld5Utx2MeMB+iCe161fWM1BRBcD9l7lYmpU1g6l47YlAEWJHk0mlRX:4zMMMe25CeMfhvRGxagcgGkJH3mlRX

Malware Config

Signatures

  • OutSteel

    OutSteel is a file uploader and document stealer written in AutoIT.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe
    "C:\Users\Admin\AppData\Local\Temp\56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
      2⤵
        PID:2244
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
        2⤵
          PID:2308
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
          2⤵
            PID:2432
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
            2⤵
              PID:2832
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
              2⤵
                PID:2848
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
                2⤵
                  PID:2576
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
                  2⤵
                    PID:2700
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
                    2⤵
                      PID:2548
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
                      2⤵
                        PID:2556
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
                        2⤵
                          PID:2376
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
                          2⤵
                            PID:1936
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
                            2⤵
                              PID:2464
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
                              2⤵
                                PID:2380
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
                                2⤵
                                  PID:2764
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
                                  2⤵
                                    PID:2084
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
                                    2⤵
                                      PID:920
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
                                      2⤵
                                        PID:1200

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/1084-1-0x0000000000C20000-0x0000000000D20000-memory.dmp
                                      Filesize

                                      1024KB

                                    • memory/1084-2-0x0000000000270000-0x000000000034D000-memory.dmp
                                      Filesize

                                      884KB

                                    • memory/1084-3-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-4-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-6-0x0000000000C20000-0x0000000000D20000-memory.dmp
                                      Filesize

                                      1024KB

                                    • memory/1084-7-0x0000000000270000-0x000000000034D000-memory.dmp
                                      Filesize

                                      884KB

                                    • memory/1084-8-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-10-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-12-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-14-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-16-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB

                                    • memory/1084-18-0x0000000000400000-0x0000000000A88000-memory.dmp
                                      Filesize

                                      6.5MB