outsteel | cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08

General

Target

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
Size

878KB
MD5

01033729316e2886515a15dc93ea85c4
SHA1

8d7e3b9e1f5cedeb6050f4808ec057fe6603c3eb
SHA256

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08
SHA512

e5c4f2c83818a01bd8db2d5222db8c4c08bdad4baf7d1a1873faaa8d6e880da5a5cfb97cfc469365edbaf746b0670a0d74ee903f26a20efa186233aabe3d1415
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHanrBrB5:Nh+ZkldoPK8Yanrx

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe

description	ioc	process
File opened (read-only)	\??\m:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\o:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\q:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\a:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\b:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\e:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\j:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\k:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\u:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\w:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\y:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\r:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\z:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\h:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\n:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\t:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\v:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\x:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\g:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\i:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\l:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\p:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
File opened (read-only)	\??\s:	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe

description	pid	process	target process
PID 2380 wrote to memory of 892	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 892	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 892	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4816	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4816	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4816	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 5056	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 5056	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 5056	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4280	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4280	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4280	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 2260	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 2260	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 2260	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3364	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3364	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3364	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4488	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4488	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4488	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3412	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3412	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3412	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4792	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4792	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4792	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3456	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3456	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3456	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 868	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 868	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 868	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 1524	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 1524	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 1524	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 1592	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 1592	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 1592	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4272	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4272	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 4272	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3944	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3944	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3944	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 740	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 740	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 740	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 368	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 368	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 368	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3496	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3496	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe
PID 2380 wrote to memory of 3496	2380	cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe
"C:\Users\Admin\AppData\Local\Temp\cd93f6df63187e3ac31ea56339f9b859b0f4fbe3e73e1c07192cef4c9a6f8b08.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
  2⤵
  PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
  2⤵
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
  2⤵
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
  2⤵
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
  2⤵
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
  2⤵
  PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
  2⤵
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
  2⤵
  PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
  2⤵
  PID:1524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
  2⤵
  PID:1592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
  2⤵
  PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
  2⤵
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
  2⤵
  PID:740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
  2⤵
  PID:368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A
  2⤵
  PID:3496