outsteel | 71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35

General

Target

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
Size

661KB
MD5

d9300ff1b9e6c7ef3f1c6cac4c30bb72
SHA1

833a8f095aa555f3fa3e873adadc0879a4bcfc5a
SHA256

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35
SHA512

820ebc7944f1eaea8ca0733aabf308b2ec6cba57a965c01fbcb697a6a6e9584855d2334bfb4b48339782f791edf6ff1740d01a5bb576c21197677d351cd76325
SSDEEP

12288:UMuiU0Jflt9Cyu8kqV2IlrRaCycHRiPTiIKDYOuBikqxK63+JTve2:TTJflCyuIltaCvITKYOu4kD63+x22

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe

description	ioc	process
File opened (read-only)	\??\q:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\x:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\n:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\o:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\s:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\y:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\j:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\k:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\m:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\u:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\w:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\a:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\e:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\l:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\i:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\p:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\r:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\t:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\v:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\b:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\g:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\h:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
File opened (read-only)	\??\z:	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/224-2-0x0000000004A80000-0x0000000004B5D000-memory.dmp	autoit_exe
behavioral2/memory/224-3-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-4-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-7-0x0000000004A80000-0x0000000004B5D000-memory.dmp	autoit_exe
behavioral2/memory/224-8-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-10-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-12-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-14-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-16-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe
behavioral2/memory/224-18-0x0000000000400000-0x0000000002C16000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe

description	pid	process	target process
PID 224 wrote to memory of 2892	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2892	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2892	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2096	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2096	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2096	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4956	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4956	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4956	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 1344	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 1344	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 1344	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4908	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4908	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4908	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2252	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2252	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2252	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4720	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4720	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4720	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2692	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2692	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2692	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 3616	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 3616	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 3616	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4628	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4628	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4628	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4224	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4224	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4224	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2256	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2256	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2256	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2956	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2956	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2956	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4656	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4656	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4656	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4312	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4312	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 4312	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2924	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2924	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2924	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2920	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2920	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe
PID 224 wrote to memory of 2920	224	71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
"C:\Users\Admin\AppData\Local\Temp\71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-1-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/224-2-0x0000000004A80000-0x0000000004B5D000-memory.dmp

Filesize
884KB

Download
memory/224-3-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-4-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-6-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/224-7-0x0000000004A80000-0x0000000004B5D000-memory.dmp

Filesize
884KB

Download
memory/224-8-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-10-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-12-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-14-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-16-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download
memory/224-18-0x0000000000400000-0x0000000002C16000-memory.dmp

Filesize
40.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads