Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
31/07/2024, 10:21
General
- Target RMS RFQ#2110474566500464 202407231.docx.com.exe
- Size 537KB
- Sample240731-mdncjasepg
- SHA256 fed0ecd2eaf8028eddfefd92b374bf515059a07daf18f30fb1e4faf9b1d4c3c2
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Detected Nirsoft tools 6 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tkvdgmlhgcraqwthzdgmiggv"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wmavheeackjfacplqnbfllamggf"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe"C:\Users\Admin\AppData\Local\Temp\RMS RFQ#2110474566500464 202407231.docx.com.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ggoghxpcpsbrcjdpaynhwxvvonxnrc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
nsbEE7B.tmp
nsbEE7B.tmp
nsbEE7B.tmp
nsbEE7B.tmp
nsgEF38.tmp
System.dll
nsqEDEC.tmp
nsqEDEC.tmp
nsqEDEC.tmp
nsqEDEC.tmp
nsqEDEC.tmp
nsqEDEC.tmp
nsqEDEC.tmp
nsqEE3B.tmp
nsqEE3B.tmp
nsqEE3B.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
nsqEED9.tmp
tkvdgmlhgcraqwthzdgmiggv
centerhalfs.ini
memory/368-585-0x0000000000400000-0x0000000000424000-memory.dmp
memory/368-589-0x0000000000400000-0x0000000000424000-memory.dmp
memory/368-590-0x0000000000400000-0x0000000000424000-memory.dmp
memory/368-593-0x0000000000400000-0x0000000000424000-memory.dmp
memory/732-577-0x00000000045B0000-0x00000000065A0000-memory.dmp
memory/732-572-0x00000000045B0000-0x00000000065A0000-memory.dmp
memory/732-574-0x0000000073BD5000-0x0000000073BD6000-memory.dmp
memory/732-573-0x0000000076F81000-0x00000000770A1000-memory.dmp
memory/2776-607-0x00000000347D0000-0x00000000347E9000-memory.dmp
memory/2776-610-0x0000000001A90000-0x0000000003A80000-memory.dmp
memory/2776-608-0x00000000347D0000-0x00000000347E9000-memory.dmp
memory/2776-604-0x00000000347D0000-0x00000000347E9000-memory.dmp
memory/2776-576-0x0000000001A90000-0x0000000003A80000-memory.dmp
memory/2776-575-0x0000000001A90000-0x0000000003A80000-memory.dmp
memory/3268-588-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3268-583-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3268-581-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3268-584-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4844-586-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4844-602-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4844-582-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4844-592-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4844-580-0x0000000000400000-0x0000000000478000-memory.dmp