95e217da4c184170c705e9ef317b5d8333713f4f91435d0964e0e2cea03100ab

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Size

2.3MB
MD5

d9615368a7ba5bb0c15e398f4097dc1f
SHA1

bc747bc86fed777358b2c71a8ea95f7ccbf3e5a4
SHA256

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3
SHA512

1b592a7a2034f881b86e7103c4fde9aed0a2095ee6e28bc61a7ff454c9ae0716a95b43785497a627e3cc66cccb6b338f4e832acdd69b0fdddb2c88f05aa73cd3
SSDEEP

49152:xTs9zpYo556eURBCDd/BP1+zX3ympAGBnEl6U8/j/SIGzgnUjQ58IkUC4:x49SoqrRBClh1+znnBd77lPO

Score

9^/10

collection discovery evasion persistence spyware stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipinfo.io
3 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

pid process

1760 01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

flow	ioc
4	ipinfo.io
3	ipinfo.io

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

580 schtasks.exe
2404 schtasks.exe

pid	process
580	schtasks.exe
2404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

pid	process
1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	pid	process	target process
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

outlook_win_path 1 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

C:\Users\Admin\AppData\Local\Temp\01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
"C:\Users\Admin\AppData\Local\Temp\01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1760

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:580

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\spanWUBZsgEEOYAI\f9W74x_MwcGEWeb Data

Filesize
92KB

MD5
2157696941ae13875f8dfe8630ea4029

SHA1
b5ff62b7900cdfc630edd94d737309042de58251

SHA256
90e438a9d6706c8a1e809bfb5babe83508cac27d3c9f3f9b8bd1cd4f3aa3e033

SHA512
61b998e42f5d0121f75e04a46177c1c3a7122dc2014b7bed1d584c9ea53146e87d7a6b9e94bde066d92580c6c2b2316dd860980e5cd8f75984286dc90e43fb6a

Download Submit
memory/1760-20-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/1760-2-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/1760-17-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-0-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-7-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1760-11-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1760-13-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1760-12-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/1760-9-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1760-10-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1760-14-0x0000000002D30000-0x0000000002D32000-memory.dmp

Filesize
8KB

Download
memory/1760-8-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/1760-6-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1760-15-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-16-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1760-21-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/1760-4-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/1760-19-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1760-18-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/1760-22-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1760-23-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1760-26-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/1760-27-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1760-30-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/1760-29-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1760-31-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-32-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-33-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/1760-34-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/1760-35-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1760-1-0x0000000077B80000-0x0000000077B82000-memory.dmp

Filesize
8KB

Download
memory/1760-73-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/1760-72-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1760-81-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download