outsteel | cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08

General

Target

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
Size

878KB
MD5

01033729316e2886515a15dc93ea85c4
SHA1

8d7e3b9e1f5cedeb6050f4808ec057fe6603c3eb
SHA256

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08
SHA512

e5c4f2c83818a01bd8db2d5222db8c4c08bdad4baf7d1a1873faaa8d6e880da5a5cfb97cfc469365edbaf746b0670a0d74ee903f26a20efa186233aabe3d1415
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHanrBrB5:Nh+ZkldoPK8Yanrx

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe

description	ioc	process
File opened (read-only)	\??\l:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\w:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\x:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\z:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\g:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\s:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\u:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\y:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\v:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\a:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\b:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\h:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\m:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\q:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\r:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\p:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\t:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\e:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\i:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\j:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\k:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\n:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\o:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe

description	pid	process	target process
PID 2460 wrote to memory of 2720	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2720	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2720	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2720	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1900	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1900	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1900	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1900	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2524	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2524	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2524	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2524	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2604	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2604	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2604	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2604	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2504	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2504	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2504	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2504	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2656	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2656	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2656	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2656	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2640	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2640	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2640	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2640	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2516	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2516	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2516	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2516	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2420	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2420	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2420	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2420	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2392	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2392	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2392	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2392	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2820	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2820	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2820	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2820	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 3048	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 3048	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 3048	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 3048	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1564	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1564	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1564	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1564	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 860	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 860	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 860	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 860	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1256	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1256	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1256	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 1256	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2556	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2556	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2556	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2460 wrote to memory of 2556	2460	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
"C:\Users\Admin\AppData\Local\Temp\cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A
  2⤵
  PID:1244