Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/11/2024, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe
Resource
win10v2004-20241007-en
General
-
Target
e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe
-
Size
1.4MB
-
MD5
44b12ec43cc992f523a020ea8de11ac7
-
SHA1
62c0df44c7fc6c3dbf3eddccf4f58a1ab8f5bf36
-
SHA256
e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043
-
SHA512
e7f272a47a740ab442c926973a044f9a546516a4dc8fca0d91b8ad18d5ab12515a76bc9851ebf2022234d90622c61c72d4deba39ce4adb78ffddef4acc066f2b
-
SSDEEP
24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aPjH+CMV/52TLI8ORQVciQ:yTvC/MTQYxsWR7aPjeXYTLjYQ
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Esher.vbs Esher.exe -
Executes dropped EXE 1 IoCs
pid Process 2688 Esher.exe -
Loads dropped DLL 1 IoCs
pid Process 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0008000000016c89-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2688 set thread context of 2588 2688 Esher.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Esher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2588 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2688 Esher.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2588 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe 2688 Esher.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2688 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 30 PID 2676 wrote to memory of 2688 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 30 PID 2676 wrote to memory of 2688 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 30 PID 2676 wrote to memory of 2688 2676 e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe 30 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 PID 2688 wrote to memory of 2588 2688 Esher.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe"C:\Users\Admin\AppData\Local\Temp\e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Okeghem\Esher.exe"C:\Users\Admin\AppData\Local\Temp\e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD544b12ec43cc992f523a020ea8de11ac7
SHA162c0df44c7fc6c3dbf3eddccf4f58a1ab8f5bf36
SHA256e5e6d62b5bae3ab4874c477f700dfa99288f56358e1194e1bda9d98d4d11b043
SHA512e7f272a47a740ab442c926973a044f9a546516a4dc8fca0d91b8ad18d5ab12515a76bc9851ebf2022234d90622c61c72d4deba39ce4adb78ffddef4acc066f2b