outsteel | 71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35

General

Target

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
Size

661KB
MD5

d9300ff1b9e6c7ef3f1c6cac4c30bb72
SHA1

833a8f095aa555f3fa3e873adadc0879a4bcfc5a
SHA256

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35
SHA512

820ebc7944f1eaea8ca0733aabf308b2ec6cba57a965c01fbcb697a6a6e9584855d2334bfb4b48339782f791edf6ff1740d01a5bb576c21197677d351cd76325
SSDEEP

12288:UMuiU0Jflt9Cyu8kqV2IlrRaCycHRiPTiIKDYOuBikqxK63+JTve2:TTJflCyuIltaCvITKYOu4kD63+x22

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe

description	ioc	process
File opened (read-only)	\??\y:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\z:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\b:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\g:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\j:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\k:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\r:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\w:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\h:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\l:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\m:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\n:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\p:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\s:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\i:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\o:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\u:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\x:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\a:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\e:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\q:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\t:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\v:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1948-2-0x0000000004570000-0x000000000464D000-memory.dmp	autoit_exe
behavioral1/memory/1948-3-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-4-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-7-0x0000000004570000-0x000000000464D000-memory.dmp	autoit_exe
behavioral1/memory/1948-8-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-10-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-12-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-15-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-17-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral1/memory/1948-19-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe

description	pid	process	target process
PID 1948 wrote to memory of 2204	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2204	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2204	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2204	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2068	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2068	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2068	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2068	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2616	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2616	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2616	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2616	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2680	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2680	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2680	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2680	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2672	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2672	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2672	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2672	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2580	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2580	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2580	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2580	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2640	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2640	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2640	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2640	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2592	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2592	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2592	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2592	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2420	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2420	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2420	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2420	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2484	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2484	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2484	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2484	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2880	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2880	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2880	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2880	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1936	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1936	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1936	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1936	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1532	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1532	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1532	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 1532	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2768	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2768	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2768	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2768	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2764	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2764	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2764	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2764	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2712	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2712	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2712	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 1948 wrote to memory of 2712	1948	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
"C:\Users\Admin\AppData\Local\Temp\71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-1-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/1948-2-0x0000000004570000-0x000000000464D000-memory.dmp

Filesize
884KB

Download
memory/1948-3-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-4-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-6-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/1948-7-0x0000000004570000-0x000000000464D000-memory.dmp

Filesize
884KB

Download
memory/1948-8-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-10-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-12-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-15-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-17-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/1948-19-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads