Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
06/06/2024, 01:54
General
- Target ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2.exe
- Size 835KB
- Sample240606-cbrxtsfb72
- SHA256 ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2.exe"C:\Users\Admin\AppData\Local\Temp\ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2' -Value '"C:\Users\Admin\AppData\Local\Temp\ce6224c2c1f6cfa9e60740d98cfbc882da6d6885ece9c4c8bd320370496830e2.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bwxfjosg.tmpdb
Tcxpjm.tmpdb
__PSScriptPolicyTest_2ggaaaq4.szq.ps1
memory/464-41-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-2366-0x00007FFFB7A33000-0x00007FFFB7A35000-memory.dmp
memory/464-2-0x000000001BB90000-0x000000001BCA6000-memory.dmp
memory/464-3-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp
memory/464-12-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-23-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-21-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-15-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-13-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-19-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-59-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-63-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-67-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-65-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-61-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-57-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-55-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-53-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-51-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-49-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-47-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-45-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-43-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-1-0x00007FFFB7A33000-0x00007FFFB7A35000-memory.dmp
memory/464-0-0x0000000000D20000-0x0000000000DF8000-memory.dmp
memory/464-35-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-39-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-33-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-31-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-28-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-17-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-29-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-26-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-7-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-5-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-9-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-4-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-2308-0x0000000002EE0000-0x0000000002F7E000-memory.dmp
memory/464-2309-0x00000000030C0000-0x000000000310C000-memory.dmp
memory/464-2310-0x0000000002F80000-0x0000000002FAC000-memory.dmp
memory/464-2311-0x000000001C4B0000-0x000000001C52A000-memory.dmp
memory/464-37-0x000000001BB90000-0x000000001BCA0000-memory.dmp
memory/464-2382-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp
memory/464-2385-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp
memory/828-2377-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp
memory/828-2376-0x00000168CA140000-0x00000168CA162000-memory.dmp
memory/828-2378-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp
memory/828-2379-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp
memory/828-2383-0x00007FFFB7A30000-0x00007FFFB84F1000-memory.dmp