Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
submitted
05-10-2024 06:56
Static task
static1
Behavioral task
behavioral1
Sample
98512fdc1d3b34e2196ca5b34e14f29c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
98512fdc1d3b34e2196ca5b34e14f29c.exe
Resource
win10v2004-20240802-en
General
-
Target
98512fdc1d3b34e2196ca5b34e14f29c.exe
-
Size
4.8MB
-
MD5
98512fdc1d3b34e2196ca5b34e14f29c
-
SHA1
460f2bbed2bc7419c1664d7f8a9e284e5b9bea83
-
SHA256
1478772a2208da0b42fd08d2e4f3506259d09c50b5af093471d6c874bf19b399
-
SHA512
ba83759ab4a14007c8344fa665329898d520f640cfab6ec7b177b191f423aa9ec9d07577d64fe11d3cbf56be1744f2e66c1fd0c8a6529fd867377e62445cd6a0
-
SSDEEP
3072:patWqvozZqlXS99bMRfCh+T5bOCYEu05ukO3JJ:pMWqcIXS99bMZ5sCYE7O3P
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7935489665:AAE2XyOo-0CSgW-NXoz80QphaaOkmebwR5Q/sendMessage?chat_id=-4573656473
http://185.80.128.17:8080
http://206.166.251.4:8080
http://167.99.138.249:8080
http://46.4.73.118:9000
http://206.189.109.146:80
http://194.164.198.113:8080
http://45.82.65.63:80
https://5.196.181.135:443
http://95.216.147.179:80
http://185.217.98.121:8080
http://116.202.101.219:8080
http://185.217.98.121:80
http://159.203.174.113:8090
http://107.161.20.142:8080
https://192.99.196.191:443
https://44.228.161.50:443
https://154.9.207.142:443
http://66.42.56.128:80
http://8.219.110.16:9999
https://138.2.92.67:443
http://8.134.71.132:8082
http://41.87.207.180:9090
http://18.228.80.130:80
http://168.138.211.88:8099
http://47.110.140.182:8080
http://129.151.109.160:8080
http://101.43.160.136:8080
http://101.132.223.26:8080
http://101.126.19.171:80
http://38.60.191.38:80
http://47.96.78.224:8080
https://101.126.19.171:443
Signatures
-
Gurcu family
-
A potential corporate email address has been identified in the URL: 0psWt_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 1Ry4E_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 3AHgj_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 3dEIS_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 3vZQd_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 47eBR_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 4PdEF_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 4qsoj_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 6VJNy_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 7F1l2_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 7vyFH_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 8L20V_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: 8hHRi_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Ax1YR_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: CbqLp_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: El5vI_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: EwYXF_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Ezgug_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: F06lq_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: FALPg_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: GQG67_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: INq9R_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Kw270_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Lf1mB_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: MOHDh_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Makje_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Nowvq_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: OYlmA_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Ouxjk_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Ozz8d_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: P68e8_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: P7fPA_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: PRVfy_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: R22Ku_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: R4rDY_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: SUBDs_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: Tlh8j_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: V00Ab_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: VZAkn_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: ZT5Xg_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: adtNb_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: dKusI_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: dTONe_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: e8SpX_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: esDFn_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: gOBJ8_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: kVjGk_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: lLS11_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: lZVCJ_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: n9zl3_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: nI5Oo_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: o20e1_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: oFe4p_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: pBY6a_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: r47lD_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: rPexd_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: tDfBz_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: whILQ_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: xgAn2_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: xvLmz_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: yeUze_Admin@JSMURNPT_report.wsr
-
A potential corporate email address has been identified in the URL: z1bmi_Admin@JSMURNPT_report.wsr
-
Deletes itself 1 IoCs
pid Process 2168 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2812 cmd.exe 1772 netsh.exe 2484 cmd.exe 1728 netsh.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2600 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 98512fdc1d3b34e2196ca5b34e14f29c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98512fdc1d3b34e2196ca5b34e14f29c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98512fdc1d3b34e2196ca5b34e14f29c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 98512fdc1d3b34e2196ca5b34e14f29c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2712 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1960 98512fdc1d3b34e2196ca5b34e14f29c.exe Token: SeDebugPrivilege 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe Token: SeDebugPrivilege 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2168 1960 98512fdc1d3b34e2196ca5b34e14f29c.exe 31 PID 1960 wrote to memory of 2168 1960 98512fdc1d3b34e2196ca5b34e14f29c.exe 31 PID 1960 wrote to memory of 2168 1960 98512fdc1d3b34e2196ca5b34e14f29c.exe 31 PID 2168 wrote to memory of 2952 2168 cmd.exe 33 PID 2168 wrote to memory of 2952 2168 cmd.exe 33 PID 2168 wrote to memory of 2952 2168 cmd.exe 33 PID 2168 wrote to memory of 2600 2168 cmd.exe 34 PID 2168 wrote to memory of 2600 2168 cmd.exe 34 PID 2168 wrote to memory of 2600 2168 cmd.exe 34 PID 2168 wrote to memory of 2712 2168 cmd.exe 35 PID 2168 wrote to memory of 2712 2168 cmd.exe 35 PID 2168 wrote to memory of 2712 2168 cmd.exe 35 PID 2168 wrote to memory of 2708 2168 cmd.exe 36 PID 2168 wrote to memory of 2708 2168 cmd.exe 36 PID 2168 wrote to memory of 2708 2168 cmd.exe 36 PID 2708 wrote to memory of 2812 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 38 PID 2708 wrote to memory of 2812 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 38 PID 2708 wrote to memory of 2812 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 38 PID 2812 wrote to memory of 1532 2812 cmd.exe 40 PID 2812 wrote to memory of 1532 2812 cmd.exe 40 PID 2812 wrote to memory of 1532 2812 cmd.exe 40 PID 2812 wrote to memory of 1772 2812 cmd.exe 41 PID 2812 wrote to memory of 1772 2812 cmd.exe 41 PID 2812 wrote to memory of 1772 2812 cmd.exe 41 PID 2812 wrote to memory of 952 2812 cmd.exe 42 PID 2812 wrote to memory of 952 2812 cmd.exe 42 PID 2812 wrote to memory of 952 2812 cmd.exe 42 PID 2708 wrote to memory of 1608 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 43 PID 2708 wrote to memory of 1608 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 43 PID 2708 wrote to memory of 1608 2708 98512fdc1d3b34e2196ca5b34e14f29c.exe 43 PID 1608 wrote to memory of 1524 1608 cmd.exe 45 PID 1608 wrote to memory of 1524 1608 cmd.exe 45 PID 1608 wrote to memory of 1524 1608 cmd.exe 45 PID 1608 wrote to memory of 2188 1608 cmd.exe 46 PID 1608 wrote to memory of 2188 1608 cmd.exe 46 PID 1608 wrote to memory of 2188 1608 cmd.exe 46 PID 1608 wrote to memory of 328 1608 cmd.exe 47 PID 1608 wrote to memory of 328 1608 cmd.exe 47 PID 1608 wrote to memory of 328 1608 cmd.exe 47 PID 1412 wrote to memory of 2992 1412 taskeng.exe 49 PID 1412 wrote to memory of 2992 1412 taskeng.exe 49 PID 1412 wrote to memory of 2992 1412 taskeng.exe 49 PID 2992 wrote to memory of 2484 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 50 PID 2992 wrote to memory of 2484 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 50 PID 2992 wrote to memory of 2484 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 50 PID 2484 wrote to memory of 2264 2484 cmd.exe 52 PID 2484 wrote to memory of 2264 2484 cmd.exe 52 PID 2484 wrote to memory of 2264 2484 cmd.exe 52 PID 2484 wrote to memory of 1728 2484 cmd.exe 53 PID 2484 wrote to memory of 1728 2484 cmd.exe 53 PID 2484 wrote to memory of 1728 2484 cmd.exe 53 PID 2484 wrote to memory of 1844 2484 cmd.exe 54 PID 2484 wrote to memory of 1844 2484 cmd.exe 54 PID 2484 wrote to memory of 1844 2484 cmd.exe 54 PID 2992 wrote to memory of 1524 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 55 PID 2992 wrote to memory of 1524 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 55 PID 2992 wrote to memory of 1524 2992 98512fdc1d3b34e2196ca5b34e14f29c.exe 55 PID 1524 wrote to memory of 908 1524 cmd.exe 57 PID 1524 wrote to memory of 908 1524 cmd.exe 57 PID 1524 wrote to memory of 908 1524 cmd.exe 57 PID 1524 wrote to memory of 660 1524 cmd.exe 58 PID 1524 wrote to memory of 660 1524 cmd.exe 58 PID 1524 wrote to memory of 660 1524 cmd.exe 58 PID 1524 wrote to memory of 2216 1524 cmd.exe 59 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98512fdc1d3b34e2196ca5b34e14f29c.exe"C:\Users\Admin\AppData\Local\Temp\98512fdc1d3b34e2196ca5b34e14f29c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "98512fdc1d3b34e2196ca5b34e14f29c" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\98512fdc1d3b34e2196ca5b34e14f29c.exe" &&START "" "C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2952
-
-
C:\Windows\system32\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:2600
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "98512fdc1d3b34e2196ca5b34e14f29c" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2712
-
-
C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe"C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:1532
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1772
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵PID:952
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:1524
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2188
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵PID:328
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {6E038E5E-4B8F-45E5-9112-580CD052E09C} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exeC:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2992 -
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:2264
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1728
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"4⤵PID:1844
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"3⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:908
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:660
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"4⤵PID:2216
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8c732ecab12d9233824ff39c37376b2
SHA1d2627fa085aa24baa257ffd9771342bf4a1c8f6d
SHA2564b34ef5671441c88311375625d06b7fe64a4ed364b3f5d7bd06f299a5739a5ab
SHA51275d1712cc800bbd4a03438b279a7e3c1c92a3ab0546492208a493501dc730397be38a34835d49beedd1dda102ebdeafae6fa334fe175b5dab12433d582debaa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e7005e30711f99e57d8685bcd065588
SHA10f38338b43b79739ef9a9cd38fa494b661fd4a8d
SHA25666b998e47d09473fe3bd05f136e4896a57813dbc42944778bf46bd05b2cb966b
SHA512de5df28e668a507d200784992dd2220534bc6c5560c67cee84ea519c3a9d793ab3c1fd53d0595d4f75d842e9c893c972480ef1062b00ee9f53fd892a2ec3de21
-
Filesize
4.8MB
MD598512fdc1d3b34e2196ca5b34e14f29c
SHA1460f2bbed2bc7419c1664d7f8a9e284e5b9bea83
SHA2561478772a2208da0b42fd08d2e4f3506259d09c50b5af093471d6c874bf19b399
SHA512ba83759ab4a14007c8344fa665329898d520f640cfab6ec7b177b191f423aa9ec9d07577d64fe11d3cbf56be1744f2e66c1fd0c8a6529fd867377e62445cd6a0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
4B
MD503924fb32bcc6248036e209a716e3339
SHA1efb632c4811ff6da19cc314f5367692afb782395
SHA2560c8b0099fc8c50e603a46709494b930ba0b848baebc1db487389eb1995bbb0af
SHA5123b9f21458c16c6dd145859b2701a0533a2c215b9add344743b5d70f08ca2f815fea2ddc8fc4985d6e1db5bc68e4ca46735adba845db0ed90e3d571e130195c5c