Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22/02/2022, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe
Resource
win10v2004-en-20220113
General
-
Target
07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe
-
Size
3.4MB
-
MD5
a823ce034acab9c8e810ca94927b3815
-
SHA1
fcbe558da3085f502ffe2ee248b955804f5dfc5b
-
SHA256
07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c
-
SHA512
1422b8205a839ed155065ea7555cde3b52cc8d82b1042e3143cd933dc31464f34c6b7fe4cc11cc65979f6f3266734ccd793668da36172b5aea35d812c2947b9d
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
N01072002n
Signatures
-
NirSoft MailPassView 8 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x0006000000013090-62.dat MailPassView behavioral1/files/0x0006000000013090-63.dat MailPassView behavioral1/files/0x0006000000013090-65.dat MailPassView behavioral1/files/0x000600000001321e-77.dat MailPassView behavioral1/files/0x000600000001321e-78.dat MailPassView behavioral1/files/0x000600000001321e-79.dat MailPassView behavioral1/memory/1956-86-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1956-89-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x0006000000013090-62.dat WebBrowserPassView behavioral1/files/0x0006000000013090-63.dat WebBrowserPassView behavioral1/files/0x0006000000013090-65.dat WebBrowserPassView behavioral1/files/0x000600000001321e-77.dat WebBrowserPassView behavioral1/files/0x000600000001321e-78.dat WebBrowserPassView behavioral1/files/0x000600000001321e-79.dat WebBrowserPassView behavioral1/memory/1536-90-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1536-93-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 10 IoCs
resource yara_rule behavioral1/files/0x0006000000013090-62.dat Nirsoft behavioral1/files/0x0006000000013090-63.dat Nirsoft behavioral1/files/0x0006000000013090-65.dat Nirsoft behavioral1/files/0x000600000001321e-77.dat Nirsoft behavioral1/files/0x000600000001321e-78.dat Nirsoft behavioral1/files/0x000600000001321e-79.dat Nirsoft behavioral1/memory/1956-86-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1956-89-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1536-90-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1536-93-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
pid Process 1288 3.exe 1000 1.exe 1632 2.exe 1736 Windows Update.exe -
Loads dropped DLL 4 IoCs
pid Process 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 1000 1.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1736 set thread context of 1956 1736 Windows Update.exe 36 PID 1736 set thread context of 1536 1736 Windows Update.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\bin_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\bin_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\bin_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\bin_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.bin rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.bin\ = "bin_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\bin_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe 1736 Windows Update.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1508 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1736 Windows Update.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1508 AcroRd32.exe 1508 AcroRd32.exe 1508 AcroRd32.exe 1736 Windows Update.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1664 wrote to memory of 1288 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 27 PID 1664 wrote to memory of 1288 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 27 PID 1664 wrote to memory of 1288 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 27 PID 1664 wrote to memory of 1288 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 27 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 524 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 28 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 556 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 29 PID 1664 wrote to memory of 1000 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 30 PID 1664 wrote to memory of 1000 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 30 PID 1664 wrote to memory of 1000 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 30 PID 1664 wrote to memory of 1000 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 30 PID 1664 wrote to memory of 1632 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 31 PID 1664 wrote to memory of 1632 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 31 PID 1664 wrote to memory of 1632 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 31 PID 1664 wrote to memory of 1632 1664 07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe 31 PID 556 wrote to memory of 1508 556 rundll32.exe 32 PID 556 wrote to memory of 1508 556 rundll32.exe 32 PID 556 wrote to memory of 1508 556 rundll32.exe 32 PID 556 wrote to memory of 1508 556 rundll32.exe 32 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1000 wrote to memory of 1736 1000 1.exe 34 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1956 1736 Windows Update.exe 36 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37 PID 1736 wrote to memory of 1536 1736 Windows Update.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe"C:\Users\Admin\AppData\Local\Temp\07f3e2d9c55de226529ac2f9d686f14877b074f58d6183ce5f30324a63fa2a0c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"2⤵
- Executes dropped EXE
PID:1288
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Mono.Cecil.dll2⤵PID:524
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\stub.bin2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\stub.bin"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
PID:1956
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"4⤵PID:1536
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Executes dropped EXE
PID:1632
-