Analysis
-
max time kernel
155s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22/02/2022, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe
Resource
win10v2004-en-20220112
General
-
Target
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe
-
Size
520KB
-
MD5
a45274215d907b452dd15f533dcdc040
-
SHA1
706058351d4e554dc7587427925b0eecb8ee6e79
-
SHA256
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a
-
SHA512
c95a34798767e0014b5f0d3482f51cde57c08af14fd531ee865a9be5f009fe2d782c129d7f1d3ca1409baaa628b408e7d6d488e434c05f4feca1270e3f68e66e
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
2009raiter97wf
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x00070000000132fe-58.dat MailPassView behavioral1/files/0x00070000000132fe-59.dat MailPassView behavioral1/files/0x00070000000132fe-60.dat MailPassView behavioral1/memory/988-66-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/988-69-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x00070000000132fe-58.dat WebBrowserPassView behavioral1/files/0x00070000000132fe-59.dat WebBrowserPassView behavioral1/files/0x00070000000132fe-60.dat WebBrowserPassView behavioral1/memory/1764-70-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1764-72-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral1/files/0x00070000000132fe-58.dat Nirsoft behavioral1/files/0x00070000000132fe-59.dat Nirsoft behavioral1/files/0x00070000000132fe-60.dat Nirsoft behavioral1/memory/988-66-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/988-69-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1764-70-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1764-72-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
pid Process 240 Windows Update.exe -
Deletes itself 1 IoCs
pid Process 240 Windows Update.exe -
Loads dropped DLL 1 IoCs
pid Process 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 240 set thread context of 988 240 Windows Update.exe 29 PID 240 set thread context of 1764 240 Windows Update.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe 240 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 240 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 240 Windows Update.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 744 wrote to memory of 240 744 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 27 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 988 240 Windows Update.exe 29 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30 PID 240 wrote to memory of 1764 240 Windows Update.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe"C:\Users\Admin\AppData\Local\Temp\0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:988
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵PID:1764
-
-