outsteel | bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc

General

Target

bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
Size

540KB
MD5

fa4d702a335aab44355c84863395617a
SHA1

a2a308cec43c9bea9260243970aa914fb8751707
SHA256

bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc
SHA512

167812dda2ee176797ead9ca7b83bc4ce5d6d6581d98858b3d9b06e3aa9bdec6c578927ffefb3246c3ec33d14c42e269011f91b6b687a5ef35f0184d4d3848f9
SSDEEP

12288:RmE3Pbja+5nDs+4EQG28nPTSabSMhPmpRUVhSh3S7ukH3N6eC2:cENs+4En28nmMkpMSqXN6q

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

description	ioc	process
File opened (read-only)	\??\r:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\w:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\x:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\z:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\e:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\o:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\h:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\k:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\n:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\q:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\t:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\u:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\b:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\g:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\y:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\p:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\s:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\v:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\i:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\l:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\m:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\a:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
File opened (read-only)	\??\j:	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

AutoIT Executable 23 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/1652-10-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-12-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-13-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-15-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-17-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-22-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-21-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-25-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-29-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-34-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-33-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-37-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-41-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-49-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-50-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-53-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-57-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-61-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-65-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-66-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-69-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-73-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/1652-87-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

description	pid	process	target process
PID 1444 set thread context of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

description pid process

Token: SeDebugPrivilege 1444 bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

description	pid	process
Token: SeDebugPrivilege	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exebd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe

description	pid	process	target process
PID 1444 wrote to memory of 1344	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1344	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1344	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1444 wrote to memory of 1652	1444	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
PID 1652 wrote to memory of 4656	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4656	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4656	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1896	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1896	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1896	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4816	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4816	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4816	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4144	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4144	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4144	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4136	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4136	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4136	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 5032	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 5032	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 5032	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1352	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1352	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1352	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4988	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4988	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4988	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4152	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4152	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4152	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4336	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4336	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4336	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4120	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4120	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4120	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3652	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3652	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3652	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1036	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1036	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 1036	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3092	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3092	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3092	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4344	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4344	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 4344	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3368	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3368	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3368	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3760	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3760	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe
PID 1652 wrote to memory of 3760	1652	bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
"C:\Users\Admin\AppData\Local\Temp\bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
  C:\Users\Admin\AppData\Local\Temp\bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
  2⤵
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
  C:\Users\Admin\AppData\Local\Temp\bd83e801b836906bab4854351b4d6000e0a435736524a504b9839b5f7bdf97cc.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
    3⤵
    PID:1036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
    3⤵
    PID:3092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A
    3⤵
    PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-14-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1444-0-0x0000000000740000-0x00000000007CC000-memory.dmp

Filesize
560KB

Download
memory/1444-2-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/1444-3-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/1444-4-0x00000000052E0000-0x0000000005356000-memory.dmp

Filesize
472KB

Download
memory/1444-5-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/1444-6-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/1444-7-0x0000000005480000-0x000000000549E000-memory.dmp

Filesize
120KB

Download
memory/1444-8-0x0000000005670000-0x00000000056EA000-memory.dmp

Filesize
488KB

Download
memory/1444-9-0x0000000005460000-0x000000000546E000-memory.dmp

Filesize
56KB

Download
memory/1444-1-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1652-22-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-37-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-13-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-15-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-17-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-10-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-21-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-25-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-29-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-34-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-33-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-12-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-41-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-49-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-50-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-53-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-57-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-61-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-65-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-66-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-69-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-73-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1652-87-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads