Resubmissions
17-04-2024 14:40
240417-r1t6tadh61 717-04-2024 14:39
240417-r1smzsdh6x 717-04-2024 14:39
240417-r1r2fscd93 717-04-2024 14:39
240417-r1rqpadh6s 717-04-2024 14:39
240417-r1fy7acd67 717-04-2024 06:10
240417-gw2d8aff43 7Analysis
-
max time kernel
299s -
max time network
305s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
17-04-2024 14:39
General
-
Target
2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe
-
Size
121KB
-
MD5
963882fd8e183b937bf5f3352acb82f1
-
SHA1
3ed03c2fd2dee0903bf254773ec9a444cd8990a4
-
SHA256
2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161
-
SHA512
23e4dc2b289bdeab55c6f9794d3801e66bb182850949c31f61a174e60b7d2a50230fd494fb4a53be7ddd9200bd01f082a57f53acc6e9e5d728f8ee8356f79280
-
SSDEEP
1536:dWRhi+kHYYBuPIXtbNN08g+vB59bFmki3zMEFUVEQqFtelOYWNO3bpSWKLkP:2k4CuQe0D9bFmkyeOE38WKLkP
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe"C:\Users\Admin\AppData\Local\Temp\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe" &&START "" "C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe"C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\1ajaqqvdrt\tor\tor-real.exe"C:\Users\Admin\AppData\Local\1ajaqqvdrt\tor\tor-real.exe" -f "C:\Users\Admin\AppData\Local\1ajaqqvdrt\tor\torrc.txt"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exeC:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exeC:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exeC:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exeC:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exeC:\Users\Admin\AppData\Local\RobloxSecurity\2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD58ce6fc704072e351679ac97d4a985574
SHA1df458b17a0f840982d4f49b60575bd945a0ead17
SHA25660b0b8d4ea271db4308ad29d730de91d40ae5afeb2dfd351520adc4b01cdb467
SHA5120f7d19646f9791e6cfcad0c00b4d5bb9edb7e298904e55a8c573c9b880db8452157859754a4d2a6fb8cf4509ac6a4aa83252d1b23897a60d506635b83e50039e
-
Filesize
2.6MB
MD58c8bc1908db7ac54e1dd393839811249
SHA100d3e7d05a0abd7dd8d764a13a90d027c06382a4
SHA256b684399e3c8c9fe286edc15d8a6e14ea9ae7795ea7b5371865140e50fb678b3a
SHA512438d374c3c0ba6db776767906f8ee5cadc4e6042c26f2da4715049f697a7d63e7d178c0e191b8edf91ed1e401401f813c34cd66c0f0b9911826d0b913f3de6d4
-
Filesize
5.8MB
MD5a7476aa58566d81d168db7b0bfd86ce2
SHA1fddfe97d68107e08d8f335dc079e4679b1d8c50e
SHA2564113d7e116c45435a217fee616d1c8fe3992d4625f9ed0a4215dbdce1a8501b4
SHA512602fb7ab3d6f58426064689fb59ea74267375e550d8384ea0801fa6d88dd37d03e0f682c0e57117aa18aaef6b4c5faa1f6918efb4b88ea3d8020ec3777815334
-
Filesize
64B
MD58d44ba5f5fed374c2816b0287fc44bb4
SHA1a4c3bd54f1a806fc11fb5dc6b6c83f99978243c7
SHA25683bd064d58feb563f7651d97cdd3323b806b1dea3eff816bfc4c4846520dbfc5
SHA512d40785155a17b97635f6b20f1d02c8d799d8ac30bf15474fce711a0dc41ac674f802120a304915b061713a65789113293b117b6001ce4157ca61477da3301f50
-
Filesize
3.5MB
MD56d48d76a4d1c9b0ff49680349c4d28ae
SHA11bb3666c16e11eff8f9c3213b20629f02d6a66cb
SHA2563f08728c7a67e4998fbdc7a7cb556d8158efdcdaf0acf75b7789dccace55662d
SHA51209a4fd7b37cf52f6a0c3bb0a7517e2d2439f4af8e03130aed3296d7448585ea5e3c0892e1e1202f658ef2d083ce13c436779e202c39620a70a17b026705c65c9
-
Filesize
1.1MB
MD5a3bf8e33948d94d490d4613441685eee
SHA175ed7f6e2855a497f45b15270c3ad4aed6ad02e2
SHA25691c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585
SHA512c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28
-
Filesize
1.0MB
MD5bd40ff3d0ce8d338a1fe4501cd8e9a09
SHA13aae8c33bf0ec9adf5fbf8a361445969de409b49
SHA256ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c
SHA512404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1
-
Filesize
1.1MB
MD5945d225539becc01fbca32e9ff6464f0
SHA1a614eb470defeab01317a73380f44db669100406
SHA256c697434857a039bf27238c105be0487a0c6c611dd36cb1587c3c6b3bf582718a
SHA512409f8f1e6d683a3cbe7954bce37013316dee086cdbd7ecda88acb5d94031cff6166a93b641875116327151823cce747bcf254c0185e0770e2b74b7c5e067bc4a
-
Filesize
246KB
MD5b77328da7cead5f4623748a70727860d
SHA113b33722c55cca14025b90060e3227db57bf5327
SHA25646541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7
SHA5122f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2
-
Filesize
512KB
MD519d7cc4377f3c09d97c6da06fbabc7dc
SHA13a3ba8f397fb95ed5df22896b2c53a326662fcc9
SHA256228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d
SHA51223711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a
-
Filesize
4.0MB
MD507244a2c002ffdf1986b454429eace0b
SHA1d7cd121caac2f5989aa68a052f638f82d4566328
SHA256e9522e6912a0124c0a8c9ff9bb3712b474971376a4eb4ca614bb1664a2b4abcf
SHA5124a09db85202723a73703c5926921fef60c3dddae21528a01936987306c5e7937463f94a2f4a922811de1f76621def2a8a597a8b38a719dd24e6ff3d4e07492ca
-
Filesize
226B
MD5f7ba3f8d76cab353fd9bfcaf086fbe43
SHA18125ef66477ff336ec7dd7cd15b9a21da586d709
SHA2567c582d184902b62eb3b60d560f5693e86d48cc09c80a372c776b094b720ca24f
SHA512ce025a4791782be6c0d92528e87ab5af2392de9dd51c4344b88cd31c8bbfe892f8618c66d8f0e865193ce972f6ca9eedc34a63d3575690ef380fedb24623de43
-
Filesize
121KB
MD56f98da9e33cd6f3dd60950413d3638ac
SHA1e630bdf8cebc165aa81464ff20c1d55272d05675
SHA256219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773
SHA5122983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c
-
Filesize
847B
MD5486ebddc86ea8b3e965d390d22283a23
SHA1eaffc047f067084867e8575c576a9ec60e094ba8
SHA25650a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d
SHA5120a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d
-
Filesize
121KB
MD5963882fd8e183b937bf5f3352acb82f1
SHA13ed03c2fd2dee0903bf254773ec9a444cd8990a4
SHA2562e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161
SHA51223e4dc2b289bdeab55c6f9794d3801e66bb182850949c31f61a174e60b7d2a50230fd494fb4a53be7ddd9200bd01f082a57f53acc6e9e5d728f8ee8356f79280
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
152KB
-
Filesize
3.0MB
-
Filesize
920KB
-
Filesize
4.1MB
-
Filesize
152KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
1004KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
920KB
-
Filesize
4.1MB
-
Filesize
1004KB
-
Filesize
272KB
-
Filesize
1.0MB
-
Filesize
516KB
-
Filesize
3.0MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
144KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB