aokigahara | 36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b

General

Target
1.exe
Size 196KB
Sample260916-tk5nqa1vaw
SHA256 36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b
MD5 0de14e58cc4de3f62c2f01cb48c5826c
SHA1 9f05045f5447d79c8c0d0f5cb589fd85c89620d3
SHA512 ab56f1af00957d9306128155a300f0c47c4f9b3b9e459ef1c21690259500c603549c5a213a842bc6ae869a5c5dad147c061310c5accec653e535de667f51febe
SSDEEP 3072:f8cKls2up9qTOeB1JlxpmlMKxoztoscTpYMu0gbPJ3E8Gq1KcKILLMWa:ylX4AP1Jl/oM1ztoTOtlGq1KcNQW
TLSH
T1AF146C03D68649FCD83AC5748AD7D23BE672B8480575B6CB2F90CE25AE95F10BB2C705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery aokigahara spyware stealer

Malware Config

Signatures

Family: Aokigahara
Aokigahara is a Windows stealer written in C.
stealer aokigahara
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
4836	taskkill.exe
5008	taskkill.exe
2420	taskkill.exe
3480	taskkill.exe
2956	taskkill.exe
4868	taskkill.exe
880	taskkill.exe
5200	taskkill.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe
3484	1.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	5200	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 880	3484	1.exe	87
PID 3484 wrote to memory of 4868	3484	1.exe	88
PID 3484 wrote to memory of 2956	3484	1.exe	89
PID 3484 wrote to memory of 3480	3484	1.exe	90
PID 3484 wrote to memory of 2420	3484	1.exe	91
PID 3484 wrote to memory of 5008	3484	1.exe	93
PID 3484 wrote to memory of 4836	3484	1.exe	94
PID 3484 wrote to memory of 5200	3484	1.exe	95
PID 3484 wrote to memory of 5724	3484	1.exe	104
PID 3484 wrote to memory of 5724	3484	1.exe	104
PID 3484 wrote to memory of 5724	3484	1.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3484
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless
  2⤵
  PID:5724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Query Registry

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~DF744f.tmp

Path C:\Users\Admin\AppData\Local\Temp\~DF744f.tmp
Size 20B
SHA256 06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b
MD5 f95e52a2aec63c58328b12b47b507ee4
SHA1 a5c60ee7d9227fcaba938dbb99521c03597fb908
SHA512 08a04cb59fb4f0adbd5e7fac82921155439750dea257315988c314affe574a6ff7fc0ae0c388f8a8f0899d59eb23f0a05ee996531922c0bb680a33c490d9eae6
MD5 SHA1 SHA512

Submit Download

memory/3484-5-0x00007FF63B1C0000-0x00007FF63B1F9000-memory.dmp

Download

memory/3484-41-0x00007FF63B1C0000-0x00007FF63B1F9000-memory.dmp