57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279

General

Target
57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
Size 1.6MB
Sample261102-m2ltlsg13v
SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
MD5 4632e6d7c4ea43050d5b57b2106c9f3d
SHA1 072863bda727c6859004d8324c20cbfb9ff816cf
SHA512 a5b3097e0efbbe613a507ee6d283b5d44b73e855ef346dc7fb0c181e060b75228e42ed274403552c3f5949da0351d81911ee3208c123facff7a28164b9a59492
SSDEEP 49152:n7uzkYJ0/19xRjx+upZOCmITTCTI0iy0A:GKt9DRZb
TLSH
T1FF755B47E5A250EDC41AC2B1930BA232B575B4054A34BDEF52A0CF612FA2FD05F7DB68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe

C:\Users\Admin\AppData\Local\Temp\57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe
"C:\Users\Admin\AppData\Local\Temp\57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

volta_debug.txt

Path C:\Users\Admin\AppData\Roaming\volta_debug.txt
Size 2KB
SHA256 1393e93d3d982c124642e19bae8a6291fb59b85e973337c8448076aa4d60c481
MD5 f612f46e1ca6bc47c1af3ba08ed090a5
SHA1 154c810b1824e1be41e2b7df4f2e3986b64432b6
SHA512 4709a19cb320ffc81189bc23646149a38368ce01555a0ee47204e04c91a9353d917388a0206186a016ccfb0036be04368158f00a1a31a6363f89f249f0941c7e
TLSH
T1E8419D4633D8CB9E2836C5732EF6B75D14F08A44E7962912A3428428B4C685EB8F5B5E
MD5 SHA1 SHA512 TLSH

Submit Download

volta_debug.txt

Path C:\Users\Admin\AppData\Roaming\volta_debug.txt
Size 92B
SHA256 f91052c12042b9174ea865e49a42e210b81b39723ed325bd53f45d391015ef1a
MD5 c4efeae7b72c1775ff70e1fd175aed9f
SHA1 0281c0fa6767bf319553966a9d4681b708356e01
SHA512 750ffda6a093d4718e3186de5709d9207e212fcc6034d7415dab3ff96f9612d99211c56adc239c6be416269634466bf327bc8341e03413b18b02c6aba6851858
TLSH
T1F9B012C747F057C255F034FC80E67200590C4230D9110017D1E420C4248C241F400001
MD5 SHA1 SHA512 TLSH

Submit Download

volta_debug.txt

Path C:\Users\Admin\AppData\Roaming\volta_debug.txt
Size 3KB
SHA256 b834b6981d6143156e2db5374228973797f47bcd180a3437e1d56b42a6cacfca
MD5 a6e551a3b3e153b15a6419d24fd2f021
SHA1 45dae49ac815e2f3bd522cb2b3b9968d8085e1d2
SHA512 4aea48d8efb61bb1de8d5e43de4dc745ecc0c75c0537d2967e86586a89175dd2e4f0bb6e8e18cf94b853b65ad91469f5fd5761ff135ef73c6c8d5d63711c0ea2
TLSH
T1FA61E01572D8CB6E383195B32EBAB75D10F09A08E7D53D12B3018818B9C645EF8F9B5E
MD5 SHA1 SHA512 TLSH

Submit Download

volta_debug.txt

Path C:\Users\Admin\AppData\Roaming\volta_debug.txt
Size 3KB
SHA256 c42ec42b61afda2ad19ae9a3de2a509cea70df8c72c90347403525fbdc0a2e51
MD5 ec29425cc39ff80fd53ce288f34dd4db
SHA1 6b87924709311c3302f524e52adc47d4e59fa744
SHA512 30a92e71fa1468eed4ed9e8175c804ad613662fbe79d43495acbf23f606c01de6579ac69e0de856a614650102223bec705726aa6add06e77a36e2c5279744da5
TLSH
T1F971EE14B2C8CBAE3831C1B72EBAB75D50B09904E7953D01B3418818F9C645EF8E9B5E
MD5 SHA1 SHA512 TLSH

Submit Download

volta_debug.txt

Path C:\Users\Admin\AppData\Roaming\volta_debug.txt
Size 4KB
SHA256 2d8de0d1a6ced7b3e52d3ff0f567429eafdcf3a2683ed3dfb5232944e8cf06e0
MD5 305bddca602da60d98fe509054b38cb3
SHA1 6a8c4d70df79c207e44f3c3b8f74f2eb2b163918
SHA512 66bdacfa016d978493b6679b38af67efa94272145dcea980a0ba99e8fa47eef8de253c6c7fada202f2cb4776b695940ad57a715ff80a8a5e6da8f67eac4a958a
SSDEEP 96:TTSBK/M/9iDh/H/Zb/p/V//R/ymrSkmimhmGzDhmqmOqmemEm0piw30A0AjDjnHt:B
TLSH
T131A1DE15A5C8CB7E3835D4B72EBAF79D50B0D908E7D62902B342881CB4CA44EB4E5B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volta_debug.txt

Path C:\Users\Admin\AppData\Roaming\volta_debug.txt
Size 243B
SHA256 6784d4dccbe6991f0a730afb782a4fe508b9071086bcc3dc3c909c96238a44bc
MD5 021e07fa363a1ade77e1fd5ea6c6d41a
SHA1 590a3a0eecbaa62621eeb2c128ac80f4c984d86d
SHA512 030e0651a422b00e6749df05e2f549a5e8abcc31c6aa8160105f624b0ff9549fc3a0c49de414156440d4f2ba6cc1b34d8d661d16ca3e5ea12c5863a1df880c3b
TLSH
T1FAD05B45B1B146D654B63C755DE537506B3C433AD4068016F7D440D220C91CDA48591E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads