Analysis
- max time kernel
145s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
- submitted
16/06/2024, 09:56
General
- Target 934dd6cd9571839de7c40a6d26881b56759bd1267a5f4baab39e47f42c8c8206.exe
- Size 971KB
- Sample240616-lyeepasfrl
- SHA256 934dd6cd9571839de7c40a6d26881b56759bd1267a5f4baab39e47f42c8c8206
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\934dd6cd9571839de7c40a6d26881b56759bd1267a5f4baab39e47f42c8c8206.exe"C:\Users\Admin\AppData\Local\Temp\934dd6cd9571839de7c40a6d26881b56759bd1267a5f4baab39e47f42c8c8206.exe"1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Dkjdeywuon.tmpdb
Gfihnhs.tmpdb
memory/3812-0-0x000002DDD6A30000-0x000002DDD6B26000-memory.dmp
memory/3812-1-0x00007FFD70AD3000-0x00007FFD70AD5000-memory.dmp
memory/3812-2-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-3-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-10-0x000002DDF1C70000-0x000002DDF1D49000-memory.dmp
memory/3812-11-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-12-0x000002DDF2030000-0x000002DDF2108000-memory.dmp
memory/3812-13-0x000002DDF2110000-0x000002DDF2226000-memory.dmp
memory/3812-14-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-28-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-36-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-77-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-75-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-73-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-71-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-69-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-67-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-65-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-63-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-61-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-59-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-57-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-55-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-53-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-50-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-48-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-46-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-44-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-42-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-40-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-38-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-34-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-32-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-30-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-26-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-24-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-22-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-16-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-51-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-20-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-18-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-15-0x000002DDF2110000-0x000002DDF2220000-memory.dmp
memory/3812-2308-0x000002DDD7000000-0x000002DDD7008000-memory.dmp
memory/3812-2309-0x000002DDF2390000-0x000002DDF242E000-memory.dmp
memory/3812-2310-0x000002DDF2430000-0x000002DDF247C000-memory.dmp
memory/3812-2311-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-2312-0x000002DDF24C0000-0x000002DDF24EC000-memory.dmp
memory/3812-2313-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-2314-0x000002DDF2540000-0x000002DDF25BA000-memory.dmp
memory/3812-2326-0x000002DDF2660000-0x000002DDF26B0000-memory.dmp
memory/3812-2371-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-2372-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp
memory/3812-2375-0x00007FFD70AD0000-0x00007FFD71592000-memory.dmp