Analysis
- max time kernel
93s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 11:10
General
- Target r6576885909847656664764.scr.exe
- Size 14KB
- Sample240711-m9pv8stepl
- SHA256 697444c2cb0a7bd6fde35bd250870e7a9aa4a2b49beb0ff2c795f8c507bb5c15
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\r6576885909847656664764.scr.exe"C:\Users\Admin\AppData\Local\Temp\r6576885909847656664764.scr.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\r6576885909847656664764.scr.exe"C:\Users\Admin\AppData\Local\Temp\r6576885909847656664764.scr.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'r6576885909847656664764.scr';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'r6576885909847656664764.scr' -Value '"C:\Users\Admin\AppData\Local\Temp\r6576885909847656664764.scr.exe"' -PropertyType 'String'3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
r6576885909847656664764.scr.exe.log
Lrgsj.tmpdb
Pjubvaoczvi.tmpdb
Qveove.tmpdb
Sjwuruxoxwh.tmpdb
__PSScriptPolicyTest_gehriaxl.o5e.ps1
memory/2604-7794-0x0000000006140000-0x00000000061BA000-memory.dmp
memory/2604-7856-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2604-7858-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2604-7793-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/2604-7792-0x00000000051E0000-0x00000000051EA000-memory.dmp
memory/2604-7791-0x0000000005A00000-0x0000000005A4C000-memory.dmp
memory/2604-7790-0x0000000005100000-0x000000000519E000-memory.dmp
memory/2604-7789-0x0000000004F30000-0x0000000004F38000-memory.dmp
memory/2604-4882-0x0000000004F80000-0x000000000508E000-memory.dmp
memory/2604-4880-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2604-4881-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2604-4878-0x0000000000900000-0x00000000009E8000-memory.dmp
memory/4732-58-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-4879-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4732-54-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-52-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-50-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-48-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-44-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-42-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-38-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-36-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-34-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-32-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-28-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-26-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-24-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-22-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-18-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-16-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-20-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-8-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-7-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-10-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-4869-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4732-4870-0x00000000095F0000-0x0000000009720000-memory.dmp
memory/4732-4871-0x0000000006AD0000-0x0000000006B1C000-memory.dmp
memory/4732-4872-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/4732-4873-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4732-4874-0x0000000001390000-0x00000000013E4000-memory.dmp
memory/4732-60-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-0-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/4732-62-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-64-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-68-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-70-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-66-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-56-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-46-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-40-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-30-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-12-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-14-0x00000000087F0000-0x0000000008ADD000-memory.dmp
memory/4732-6-0x00000000087F0000-0x0000000008AE2000-memory.dmp
memory/4732-5-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4732-4-0x00000000059A0000-0x00000000059AA000-memory.dmp
memory/4732-1-0x0000000000E60000-0x0000000000E6A000-memory.dmp
memory/4732-2-0x0000000005F10000-0x00000000064B4000-memory.dmp
memory/4732-3-0x0000000005A00000-0x0000000005A92000-memory.dmp
memory/5700-7870-0x0000000006380000-0x00000000066D4000-memory.dmp
memory/5700-7854-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/5700-7859-0x0000000005A70000-0x0000000005A92000-memory.dmp
memory/5700-7855-0x0000000005B70000-0x0000000006198000-memory.dmp
memory/5700-7860-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/5700-7853-0x0000000003010000-0x0000000003046000-memory.dmp
memory/5700-7857-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/5700-7871-0x0000000006930000-0x000000000694E000-memory.dmp
memory/5700-7872-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/5700-7873-0x0000000006E70000-0x0000000006F06000-memory.dmp
memory/5700-7874-0x0000000006DF0000-0x0000000006E0A000-memory.dmp
memory/5700-7875-0x0000000006E40000-0x0000000006E62000-memory.dmp
memory/5700-7878-0x00000000744E0000-0x0000000074C90000-memory.dmp