0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862

General

Target
0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Size 136KB
Sample241107-ch4j7stckm
SHA256 0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862
MD5 cd0da55aa7811e92f71088f57df9a493
SHA1 a9430383ea4500243858a74d51bc4dcb5eda23c2
SHA512 bf5d77ef88a13ae5ee18049331c83c78342ddd6a00cc738ffc70f9e05d216e7acbd691cb9358be39fddc658a40f7b813932c0d78f93e37f589df736ba9069ef6
SSDEEP 3072:CaWWGbrPnlMV6u9bXuP087qRtNmo6mClbZCW:CTWGHdMgu9bXK0KqNmoCjC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4960	cmd.exe
4792	netsh.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4924	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4960	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe	83
PID 4492 wrote to memory of 4960	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe	83
PID 4960 wrote to memory of 1056	4960	cmd.exe	85
PID 4960 wrote to memory of 1056	4960	cmd.exe	85
PID 4960 wrote to memory of 4792	4960	cmd.exe	86
PID 4960 wrote to memory of 4792	4960	cmd.exe	86
PID 4960 wrote to memory of 3812	4960	cmd.exe	87
PID 4960 wrote to memory of 3812	4960	cmd.exe	87
PID 4492 wrote to memory of 4156	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe	89
PID 4492 wrote to memory of 4156	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe	89
PID 4156 wrote to memory of 1296	4156	cmd.exe	91
PID 4156 wrote to memory of 1296	4156	cmd.exe	91
PID 4156 wrote to memory of 4004	4156	cmd.exe	92
PID 4156 wrote to memory of 4004	4156	cmd.exe	92
PID 4156 wrote to memory of 2272	4156	cmd.exe	93
PID 4156 wrote to memory of 2272	4156	cmd.exe	93
PID 4492 wrote to memory of 3644	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe	100
PID 4492 wrote to memory of 3644	4492	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe	100
PID 3644 wrote to memory of 972	3644	cmd.exe	102
PID 3644 wrote to memory of 972	3644	cmd.exe	102
PID 3644 wrote to memory of 4924	3644	cmd.exe	103
PID 3644 wrote to memory of 4924	3644	cmd.exe	103

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe

C:\Users\Admin\AppData\Local\Temp\0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe
"C:\Users\Admin\AppData\Local\Temp\0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe"
1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4492
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1056
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4792
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:3812
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1296
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4004
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:2272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\0d503ceee2af7760bc677a71274ed2ba2c0b7d746f48fb816e091a7c92c55862.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:972
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:4924