Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 20:03
Static task
static1
Behavioral task
behavioral1
Sample
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe
Resource
win11-20240419-en
General
-
Target
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe
-
Size
479KB
-
MD5
aed761007fae099d18aa07f3508044f7
-
SHA1
3d388cc83110f82f36c01a49423c667dcb55918e
-
SHA256
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77
-
SHA512
9e28a4a008ad8b4e9996c4ae9971e2b626dfa30c290347c06e77efb8d45488e3954205ba702713bde11721959fa7290f76e9f7aaa448d4e02a4cef9e77bcfb2a
-
SSDEEP
12288:+88++tFbglwZgk4WGg8lzM74W9xyBS3iAv629arNvtUal7:+85+tFb0Dk4brlma8iKj9arNvyg
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exepid process 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exedescription pid process Token: SeDebugPrivilege 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.execmd.execmd.exedescription pid process target process PID 116 wrote to memory of 5108 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe svchost.exe PID 116 wrote to memory of 5108 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe svchost.exe PID 116 wrote to memory of 1936 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe cmd.exe PID 116 wrote to memory of 1936 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe cmd.exe PID 1936 wrote to memory of 2028 1936 cmd.exe chcp.com PID 1936 wrote to memory of 2028 1936 cmd.exe chcp.com PID 1936 wrote to memory of 2056 1936 cmd.exe netsh.exe PID 1936 wrote to memory of 2056 1936 cmd.exe netsh.exe PID 1936 wrote to memory of 2200 1936 cmd.exe findstr.exe PID 1936 wrote to memory of 2200 1936 cmd.exe findstr.exe PID 116 wrote to memory of 2796 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe cmd.exe PID 116 wrote to memory of 2796 116 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe cmd.exe PID 2796 wrote to memory of 3480 2796 cmd.exe chcp.com PID 2796 wrote to memory of 3480 2796 cmd.exe chcp.com PID 2796 wrote to memory of 4992 2796 cmd.exe netsh.exe PID 2796 wrote to memory of 4992 2796 cmd.exe netsh.exe PID 2796 wrote to memory of 1248 2796 cmd.exe findstr.exe PID 2796 wrote to memory of 1248 2796 cmd.exe findstr.exe -
outlook_office_path 1 IoCs
Processes:
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe -
outlook_win_path 1 IoCs
Processes:
d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe"C:\Users\Admin\AppData\Local\Temp\d6178b0a2267a5250f602a5cb8f259b18287173c86f97483e21d482ca7faef77.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:116 -
C:\Windows\SYSTEM32\svchost.exesvchost.exe2⤵PID:5108
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2028
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:2056
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"3⤵PID:2200
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3480
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid3⤵PID:4992
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"3⤵PID:1248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/116-1-0x00000233E0A20000-0x00000233E0A46000-memory.dmpFilesize
152KB
-
memory/116-0-0x00007FFF0B530000-0x00007FFF0B725000-memory.dmpFilesize
2.0MB
-
memory/116-3-0x00000233E2410000-0x00000233E2434000-memory.dmpFilesize
144KB
-
memory/116-4-0x00007FFEECF00000-0x00007FFEED9C1000-memory.dmpFilesize
10.8MB
-
memory/116-7-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB
-
memory/116-6-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB
-
memory/116-5-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB
-
memory/116-8-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB
-
memory/116-9-0x00007FFEECF00000-0x00007FFEED9C1000-memory.dmpFilesize
10.8MB
-
memory/116-11-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB
-
memory/116-10-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB
-
memory/116-12-0x00000233FAE30000-0x00000233FAE40000-memory.dmpFilesize
64KB