outsteel | ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c

General

Target

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
Size

990KB
MD5

c96cfe462657240c155d4b1842292a4c
SHA1

e94483c338213c667720a44d89c12a3f50547c71
SHA256

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c
SHA512

7c8b24dcd2a5d7227ba25bcbc23fda63f851f5bf71662201c4bd237f0a94ad1f20a877ab7276a4cd22fba0068a5df3dd7de9a33f6afffe2fb13c7d477cce798e
SSDEEP

12288:9GRx1eEHiQ5/lLXYsQwYfKu+eYbVcOoUv5hKo9HdwQCQBC7rD8kkSuEdz5s61qj:1EHiQf5+fZ+eYxcZO1jo7XuEDs9

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	ioc	process
File opened (read-only)	\??\e:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\g:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\j:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\k:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\q:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\u:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\a:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\h:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\o:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\v:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\y:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\b:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\l:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\m:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\r:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\s:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\t:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\z:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\i:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\n:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\p:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\w:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\x:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

AutoIT Executable 18 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/3048-4-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-6-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-8-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-9-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-11-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-17-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-19-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-23-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-27-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-31-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-35-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-43-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-47-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-51-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-55-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-59-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-63-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral1/memory/3048-77-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	pid	process	target process
PID 1784 set thread context of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description pid process

Token: SeDebugPrivilege 1784 ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	pid	process
Token: SeDebugPrivilege	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exeff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	pid	process	target process
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 1784 wrote to memory of 3048	1784	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 3048 wrote to memory of 2652	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2652	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2652	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2652	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2576	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2576	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2576	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2576	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2716	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2716	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2716	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2716	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2264	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2264	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2264	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2264	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2620	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2620	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2620	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2620	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2520	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2520	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2520	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2520	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1952	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1952	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1952	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1952	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2784	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2784	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2784	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2784	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1540	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1540	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1540	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1540	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1928	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1928	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1928	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1928	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1044	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1044	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1044	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1044	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1600	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1600	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1600	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1600	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2780	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2780	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2780	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 2780	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3048 wrote to memory of 1448	3048	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
"C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
  C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
    3⤵
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-7-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1784-0-0x0000000000DD0000-0x0000000000ECC000-memory.dmp

Filesize
1008KB

Download
memory/1784-2-0x0000000004C10000-0x0000000004C50000-memory.dmp

Filesize
256KB

Download
memory/1784-3-0x00000000009A0000-0x00000000009C2000-memory.dmp

Filesize
136KB

Download
memory/1784-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/3048-17-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-31-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-8-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-9-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-11-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-4-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-19-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-23-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-27-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-6-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-35-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-43-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-47-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-51-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-55-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-59-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-63-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3048-77-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads