Analysis

  • max time kernel
    91s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 01:49

General

  • Target

    c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe

  • Size

    1.6MB

  • MD5

    19b9de641a480be1236dd9712d9ccc10

  • SHA1

    a3cbbd66a0a3fbb2618c9283d44a0855059e9e6a

  • SHA256

    c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd

  • SHA512

    7c86fa655d20e23bb67761367b8dd0512902c0f2d3c0801f480a63bd7d8287f16e8314f43de7a202495b17aab52f7ae2b4bc71b3f0973b4e3810c4ade4462010

  • SSDEEP

    49152:LzL+zEqvftsAyChHQTTu7XIP+WQ55KGRK04TYS:LzLYVdiCh6Cdb7RD4T

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • Detects executables packed with ConfuserEx Mod 2 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
    "C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:4604
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • Drops startup file
        • Loads dropped DLL
        • Windows security modification
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:3684
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
            4⤵
            • Creates scheduled task(s)
            PID:1748
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3000
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
            4⤵
            • Creates scheduled task(s)
            PID:5020
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 3060
          3⤵
          • Program crash
          PID:5108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3684 -ip 3684
      1⤵
        PID:3812

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe

              Filesize

              63KB

              MD5

              0d5df43af2916f47d00c1573797c1a13

              SHA1

              230ab5559e806574d26b4c20847c368ed55483b0

              SHA256

              c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

              SHA512

              f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wok0udeq.0re.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\jobA3BsCS2M9VpGvt\Browsers\Vault_IE\Passwords.txt

              Filesize

              4KB

              MD5

              781ea032c0bd2e8fadb8eac2643ea5d6

              SHA1

              17ada31509ae487a3f088dc08c3b11858b6695b8

              SHA256

              bb722d1c141ea6ad651601596691801755657c622807769325b678e2854e6a81

              SHA512

              e4e3a00721d158ad1ab9d236bca2da289ce4fc7fdd0a5a531c9415f9f0f88bd8dbd7e1427fe91225f21ee24efda2d265313670e7ba8ddd164e40b1d05d8a7f61

            • C:\Users\Admin\AppData\Local\Temp\jobA4BsCS2M9VpGvt\sqlite3.dll

              Filesize

              791KB

              MD5

              0fe0a178f711b623a8897e4b0bb040d1

              SHA1

              01ea412aeab3d331f825d93d7ee1f5fa6d3c46e6

              SHA256

              0c7cd52abdb6eb3e556d81caac398a127495e4a251ef600e6505a81385a1982d

              SHA512

              6c53c489c4464b9dc9a5dd31c48bb4afa65f7d6df9cc71e705cea2074ebd5e249cad4894eac6f6b308b3574633bc6e1706dfc5fda5f46c27f1e37d21e65fbc54

            • memory/3684-9-0x0000000005640000-0x0000000005994000-memory.dmp

              Filesize

              3.3MB

            • memory/3684-6-0x0000000000400000-0x000000000069E000-memory.dmp

              Filesize

              2.6MB

            • memory/3684-10-0x0000000005A80000-0x0000000005B12000-memory.dmp

              Filesize

              584KB

            • memory/3684-11-0x0000000005B20000-0x0000000005B86000-memory.dmp

              Filesize

              408KB

            • memory/3684-12-0x0000000005D10000-0x0000000005D86000-memory.dmp

              Filesize

              472KB

            • memory/3684-8-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

              Filesize

              4KB

            • memory/3684-71-0x00000000069A0000-0x00000000069BE000-memory.dmp

              Filesize

              120KB

            • memory/3684-3-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

              Filesize

              4KB

            • memory/3684-1-0x0000000000400000-0x000000000069E000-memory.dmp

              Filesize

              2.6MB

            • memory/4360-0-0x0000000001090000-0x0000000001091000-memory.dmp

              Filesize

              4KB

            • memory/4360-2-0x0000000001090000-0x0000000001091000-memory.dmp

              Filesize

              4KB

            • memory/4404-32-0x000000006DA40000-0x000000006DA8C000-memory.dmp

              Filesize

              304KB

            • memory/4404-48-0x0000000007D00000-0x0000000007D1A000-memory.dmp

              Filesize

              104KB

            • memory/4404-28-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-29-0x00000000069E0000-0x00000000069FE000-memory.dmp

              Filesize

              120KB

            • memory/4404-30-0x0000000006A00000-0x0000000006A4C000-memory.dmp

              Filesize

              304KB

            • memory/4404-17-0x0000000006200000-0x0000000006266000-memory.dmp

              Filesize

              408KB

            • memory/4404-31-0x0000000006FA0000-0x0000000006FD2000-memory.dmp

              Filesize

              200KB

            • memory/4404-42-0x0000000007990000-0x00000000079AE000-memory.dmp

              Filesize

              120KB

            • memory/4404-44-0x0000000007BC0000-0x0000000007C63000-memory.dmp

              Filesize

              652KB

            • memory/4404-45-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-43-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-46-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-47-0x0000000008340000-0x00000000089BA000-memory.dmp

              Filesize

              6.5MB

            • memory/4404-27-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-49-0x0000000007D70000-0x0000000007D7A000-memory.dmp

              Filesize

              40KB

            • memory/4404-50-0x0000000007F80000-0x0000000008016000-memory.dmp

              Filesize

              600KB

            • memory/4404-51-0x0000000007F00000-0x0000000007F11000-memory.dmp

              Filesize

              68KB

            • memory/4404-52-0x0000000007F30000-0x0000000007F3E000-memory.dmp

              Filesize

              56KB

            • memory/4404-53-0x0000000007F40000-0x0000000007F54000-memory.dmp

              Filesize

              80KB

            • memory/4404-54-0x0000000008040000-0x000000000805A000-memory.dmp

              Filesize

              104KB

            • memory/4404-55-0x0000000008020000-0x0000000008028000-memory.dmp

              Filesize

              32KB

            • memory/4404-58-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-16-0x0000000005B10000-0x0000000005B32000-memory.dmp

              Filesize

              136KB

            • memory/4404-14-0x0000000005B60000-0x0000000006188000-memory.dmp

              Filesize

              6.2MB

            • memory/4404-15-0x0000000074A80000-0x0000000075230000-memory.dmp

              Filesize

              7.7MB

            • memory/4404-13-0x00000000030E0000-0x0000000003116000-memory.dmp

              Filesize

              216KB