6a322a2536a058719f5582f3e30dd6027a511a630bcb200e692789390454b93b

General

Target

5a309fcd_extracted.exe
Size

553KB
MD5

e27983bf177c040d309b0ccb09b102f6
SHA1

1066d80809b5005d0c112fba42044095375ce08f
SHA256

6a322a2536a058719f5582f3e30dd6027a511a630bcb200e692789390454b93b
SHA512

869c273ba7d3f48f139feefbd81ab89593ec705f40371300ee8aa4c4f2f504facb8a8a4385c3a16c6708fa9dc04d61145b16ee73b25b7a4cd24d18a135d84677

Score

9^/10

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/636-7-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/636-8-0x000000000041211A-mapping.dmp	MailPassView
behavioral2/memory/636-9-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/2524-3-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/2524-4-0x0000000000444D30-mapping.dmp	WebBrowserPassView
behavioral2/memory/2524-5-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2524-3-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/2524-4-0x0000000000444D30-mapping.dmp	Nirsoft
behavioral2/memory/2524-5-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/636-7-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/636-8-0x000000000041211A-mapping.dmp	Nirsoft
behavioral2/memory/636-9-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 bot.whatismyipaddress.com

flow	ioc
19	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

5a309fcd_extracted.exe

description	pid	process	target process
PID 4692 set thread context of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 set thread context of 636	4692	5a309fcd_extracted.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

vbc.exe5a309fcd_extracted.exe

pid process

2524 vbc.exe
2524 vbc.exe
2524 vbc.exe
2524 vbc.exe
4692 5a309fcd_extracted.exe
4692 5a309fcd_extracted.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5a309fcd_extracted.exe

description pid process

Token: SeDebugPrivilege 4692 5a309fcd_extracted.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5a309fcd_extracted.exe

pid process

4692 5a309fcd_extracted.exe

pid	process
2524	vbc.exe
2524	vbc.exe
2524	vbc.exe
2524	vbc.exe
4692	5a309fcd_extracted.exe
4692	5a309fcd_extracted.exe

description	pid	process
Token: SeDebugPrivilege	4692	5a309fcd_extracted.exe

pid	process
4692	5a309fcd_extracted.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5a309fcd_extracted.exe

description	pid	process	target process
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 2524	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe
PID 4692 wrote to memory of 636	4692	5a309fcd_extracted.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\5a309fcd_extracted.exe
"C:\Users\Admin\AppData\Local\Temp\5a309fcd_extracted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB9D0.tmp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpCC20.tmp"
  2⤵
  PID:636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB9D0.tmp

MD5
814b5ce4cad79d36055d2d4b5958cc31

SHA1
2a06a869615f0858479371b0415899681fb0c7d8

SHA256
6d1fa1a75faec2b39e8a2a1df8dd0f15e5256de7da7c527225ecf22fdacaf559

SHA512
a82fa1594ccbe1df93a973a01c787a6baa0ce8a97c0b0b0a844c90cb6be092b1094636b4d88c568fece95cd9bdfe4412875011abe318373a4fcfc218f93d1278

Download Submit
memory/636-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/636-8-0x000000000041211A-mapping.dmp

Download
memory/636-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2524-3-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2524-4-0x0000000000444D30-mapping.dmp

Download
memory/2524-5-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4692-2-0x00000000016F0000-0x00000000016F1000-memory.dmp

Filesize
4KB

Download
memory/4692-10-0x00000000016F1000-0x00000000016F2000-memory.dmp

Filesize
4KB

Download
memory/4692-11-0x00000000016F4000-0x00000000016F6000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads