outsteel | f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99

General

Target

f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
Size

700KB
MD5

cf584e69d6832fb7f92af0633e6e5222
SHA1

fb652a73f6d6de07d22e13de5a19e9fc6f9814b5
SHA256

f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99
SHA512

f7d6a3a404e18bc598abc86623a3f16083c26d5b29fe37ddf502cd52bec99d80674ccc06d896472950059db947654dd2c0126b3293d2c504a596eef23cbb64ba
SSDEEP

12288:ypl5v4OmcfiIhLibgvPjXzaVDScECKuUytXV1rx/ci13p/6EgEVsa0L:w2OzfiIhLigvrXkSw8SV9xEi139TgEi7

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe

description	ioc	process
File opened (read-only)	\??\i:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\l:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\o:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\t:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\w:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\b:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\g:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\j:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\k:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\u:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\x:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\a:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\m:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\n:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\v:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\y:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\z:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\e:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\p:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\q:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\r:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\s:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
File opened (read-only)	\??\h:	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2164-3-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-2-0x0000000000230000-0x000000000030D000-memory.dmp	autoit_exe
behavioral1/memory/2164-4-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-7-0x0000000000230000-0x000000000030D000-memory.dmp	autoit_exe
behavioral1/memory/2164-8-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-10-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-12-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-14-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-16-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe
behavioral1/memory/2164-18-0x0000000000400000-0x00000000008A7000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe

description	pid	process	target process
PID 2164 wrote to memory of 2064	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2064	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2064	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2064	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2516	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2516	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2516	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2516	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2564	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2564	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2564	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2564	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2644	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2644	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2644	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2644	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2580	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2580	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2580	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2580	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2720	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2720	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2720	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2720	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2452	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2452	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2452	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2452	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2592	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2592	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2592	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2592	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2420	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2420	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2420	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2420	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2496	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2496	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2496	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2496	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2984	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2984	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2984	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2984	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 1708	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 1708	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 1708	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 1708	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2656	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2656	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2656	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2656	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2768	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2768	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2768	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2768	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2800	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2800	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2800	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 2800	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 476	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 476	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 476	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe
PID 2164 wrote to memory of 476	2164	f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
"C:\Users\Admin\AppData\Local\Temp\f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-3-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-2-0x0000000000230000-0x000000000030D000-memory.dmp

Filesize
884KB

Download
memory/2164-1-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/2164-4-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-6-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/2164-7-0x0000000000230000-0x000000000030D000-memory.dmp

Filesize
884KB

Download
memory/2164-8-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-10-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-12-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-14-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-16-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download
memory/2164-18-0x0000000000400000-0x00000000008A7000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads