stealerium | 5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b

Analysis

max time kernel
148s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Size

1.6MB
MD5

5c51643f4c3ca737d3162d82840761c7
SHA1

dede91d3e74af7b5f67a65c0fffc2fc8ca349b32
SHA256

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b
SHA512

8215fb4221a725918e6eb89cb7e755c185eff496e4b0d3116898411ac73841fffaed4ebfb1d1de512b61e676950b5ceec115f1533622a40ed1a51abf2ecb6468
SSDEEP

49152:ULTq24GjdGSiqkqXfd+/9AqYanieKdQc:UiEjdGSiqkqXf0FLYW

Score

10^/10

stealerium collection spyware stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1244281935228965048/sJAD8BhTylLJViwx58UHGY7unbr6jQqQZSC4HrgK1L_fWJYHE1waujg1JuSnxcq9zxf6

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 discord.com
5 discord.com
24 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 icanhazip.com

flow	ioc
4	discord.com
5	discord.com
24	discord.com

flow	ioc
8	icanhazip.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

pid	process
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
Token: SeRestorePrivilege	1536	msiexec.exe
Token: SeTakeOwnershipPrivilege	1536	msiexec.exe
Token: SeSecurityPrivilege	1536	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

pid process

1960 5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.execmd.execmd.exe

description	pid	process	target process
PID 1960 wrote to memory of 2504	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 1960 wrote to memory of 2504	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 1960 wrote to memory of 2504	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 1960 wrote to memory of 2504	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 2504 wrote to memory of 2796	2504	cmd.exe	chcp.com
PID 2504 wrote to memory of 2796	2504	cmd.exe	chcp.com
PID 2504 wrote to memory of 2796	2504	cmd.exe	chcp.com
PID 2504 wrote to memory of 2796	2504	cmd.exe	chcp.com
PID 2504 wrote to memory of 1904	2504	cmd.exe	netsh.exe
PID 2504 wrote to memory of 1904	2504	cmd.exe	netsh.exe
PID 2504 wrote to memory of 1904	2504	cmd.exe	netsh.exe
PID 2504 wrote to memory of 1904	2504	cmd.exe	netsh.exe
PID 2504 wrote to memory of 1312	2504	cmd.exe	findstr.exe
PID 2504 wrote to memory of 1312	2504	cmd.exe	findstr.exe
PID 2504 wrote to memory of 1312	2504	cmd.exe	findstr.exe
PID 2504 wrote to memory of 1312	2504	cmd.exe	findstr.exe
PID 1960 wrote to memory of 640	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 1960 wrote to memory of 640	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 1960 wrote to memory of 640	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 1960 wrote to memory of 640	1960	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe	cmd.exe
PID 640 wrote to memory of 2172	640	cmd.exe	chcp.com
PID 640 wrote to memory of 2172	640	cmd.exe	chcp.com
PID 640 wrote to memory of 2172	640	cmd.exe	chcp.com
PID 640 wrote to memory of 2172	640	cmd.exe	chcp.com
PID 640 wrote to memory of 1596	640	cmd.exe	netsh.exe
PID 640 wrote to memory of 1596	640	cmd.exe	netsh.exe
PID 640 wrote to memory of 1596	640	cmd.exe	netsh.exe
PID 640 wrote to memory of 1596	640	cmd.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

outlook_win_path 1 IoCs

Processes:

5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe

C:\Users\Admin\AppData\Local\Temp\5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe
"C:\Users\Admin\AppData\Local\Temp\5a7f0ae453a4302dc288e00b6392923906ead1f181d338ab1c02a4a78f78593b.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1960

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
2⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2796

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
3⤵
PID:1904

C:\Windows\SysWOW64\findstr.exe
findstr All
3⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
2⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2172

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
3⤵
PID:1596

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\Admin@IZKCKOTP_en-US\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\Admin@IZKCKOTP_en-US\Directories\Startup.txt
Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\Admin@IZKCKOTP_en-US\Directories\Videos.txt
Filesize
23B

MD5
1fddbf1169b6c75898b86e7e24bc7c1f

SHA1
d2091060cb5191ff70eb99c0088c182e80c20f8c

SHA256
a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

SHA512
20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\Admin@IZKCKOTP_en-US\System\Apps.txt
Filesize
6KB

MD5
644d9f9d111d72a0928a4f0025b37667

SHA1
a191836e6a1c34c1616338003007476a1cb47470

SHA256
7a89ae9dd2a5ee5425d8c716817f873a2dc53e5bc27b4368d9ee0365c8fbf631

SHA512
71cc76287ea0fac89fe739951ef2349e7e9769a77044b4f95e00ec1e108707c9acd73a8b651dcbafdb8451db2e825b58f13b0e8674b33d9eb1d727e3b356be89

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\Admin@IZKCKOTP_en-US\System\Debug.txt
Filesize
320B

MD5
66762157ab5571f35e5899b26528f7c0

SHA1
f2821109fb1ce9af06a2a7fc2013f88ce08152b0

SHA256
60a44865028bb19b65837d4c470126e2ea8d07f5ece8d7260de19990df543af6

SHA512
e616ea0e2aacb87b92b4778eac85e08966e8e54afe7541a2c350109a50937d19a44eacf789b3e7756821df8a395bea16f4140fb9d853c7c14a89a47e3e6832f0

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\Admin@IZKCKOTP_en-US\System\ProductKey.txt
Filesize
29B

MD5
cad6c6bee6c11c88f5e2f69f0be6deb7

SHA1
289d74c3bebe6cca4e1d2e084482ad6d21316c84

SHA256
dc288491fadc4a85e71085890e3d6a7746e99a317cd5ef09a30272dfb10398c0

SHA512
e02cf6bff8b4ebd7a1346ecb1667be36c3ef7415fff77c3b9cfb370f3d0dc861f74d3e0e49065699850ba6cc025cd68d14ceb73f3b512c2a9b28873a69aff097

Download Submit
C:\Users\Admin\AppData\Local\7e5ed9613cbbbdbc7234c47119ed5e2d\msgid.dat
Filesize
19B

MD5
4c74545403f13ee4f19fed0ee7dc83bd

SHA1
943e76157018777292c1ebf9365259244e0b9139

SHA256
d68c5d95cbb5b8b537aed657d6ec09454cd10fb2a33afb99d22bddd11113f558

SHA512
23d7b07395f51616fc12397c16fcb67f3d72a70f126a293e34d5cdd871829cb3a372ed611c042ab9c8b86fb69e6e06dd978f7ee1a5963cfffaba1e25bb469dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4486.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1960-8-0x0000000000770000-0x0000000000778000-memory.dmp

Filesize
32KB

Download
memory/1960-48-0x0000000000CF0000-0x0000000000D0E000-memory.dmp

Filesize
120KB

Download
memory/1960-47-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download
memory/1960-46-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/1960-166-0x0000000005EE0000-0x0000000005F5A000-memory.dmp

Filesize
488KB

Download
memory/1960-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Filesize
4KB

Download
memory/1960-7-0x0000000000960000-0x0000000000986000-memory.dmp

Filesize
152KB

Download
memory/1960-6-0x0000000004AD0000-0x0000000004B62000-memory.dmp

Filesize
584KB

Download
memory/1960-2-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/1960-230-0x0000000006E10000-0x0000000006EC2000-memory.dmp

Filesize
712KB

Download
memory/1960-233-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000001260000-0x00000000013F2000-memory.dmp

Filesize
1.6MB

Download
memory/1960-245-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download