Overview

overview

10

Static

static

10

5a309fcd_e...ed.exe

windows7_x64

9

5a309fcd_e...ed.exe

windows10_x64

9

Analysis

  • max time kernel
    116s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-03-2021 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a309fcd_extracted.exe

  • Size

    553KB

  • MD5

    e27983bf177c040d309b0ccb09b102f6

  • SHA1

    1066d80809b5005d0c112fba42044095375ce08f

  • SHA256

    6a322a2536a058719f5582f3e30dd6027a511a630bcb200e692789390454b93b

  • SHA512

    869c273ba7d3f48f139feefbd81ab89593ec705f40371300ee8aa4c4f2f504facb8a8a4385c3a16c6708fa9dc04d61145b16ee73b25b7a4cd24d18a135d84677

Score
9/10

Malware Config

Signatures

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a309fcd_extracted.exe
    "C:\Users\Admin\AppData\Local\Temp\5a309fcd_extracted.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB9D0.tmp"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2524
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpCC20.tmp"
      2⤵
        PID:636

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scripting

    1
    T1064

    Persistence

    Privilege Escalation

    Defense Evasion

    Scripting

    1
    T1064

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpB9D0.tmp
      MD5

      814b5ce4cad79d36055d2d4b5958cc31

      SHA1

      2a06a869615f0858479371b0415899681fb0c7d8

      SHA256

      6d1fa1a75faec2b39e8a2a1df8dd0f15e5256de7da7c527225ecf22fdacaf559

      SHA512

      a82fa1594ccbe1df93a973a01c787a6baa0ce8a97c0b0b0a844c90cb6be092b1094636b4d88c568fece95cd9bdfe4412875011abe318373a4fcfc218f93d1278

      Download Submit
    • memory/636-7-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/636-8-0x000000000041211A-mapping.dmp
      Download
    • memory/636-9-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/2524-3-0x0000000000400000-0x000000000045C000-memory.dmp
      Filesize

      368KB

      Download
    • memory/2524-4-0x0000000000444D30-mapping.dmp
      Download
    • memory/2524-5-0x0000000000400000-0x000000000045C000-memory.dmp
      Filesize

      368KB

      Download
    • memory/4692-2-0x00000000016F0000-0x00000000016F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4692-10-0x00000000016F1000-0x00000000016F2000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4692-11-0x00000000016F4000-0x00000000016F6000-memory.dmp
      Filesize

      8KB

      Download