Analysis
-
max time kernel
142s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22/02/2022, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe
Resource
win10v2004-en-20220112
General
-
Target
0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe
-
Size
520KB
-
MD5
d88af359378d2afd51635420f0b1d817
-
SHA1
1ae351776af8c551d9d5b4a905ead037b354dda9
-
SHA256
0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6
-
SHA512
76179ddf5700fe4827181f03e06ba3e135a5af42c1662f3c5fc43dbe6d5653ce5b031ee14fee02b16165d9b40f84da527941353e8be5ae7336a300c73f5fcdb4
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
@BlessAmerica12
Signatures
-
NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x00070000000125a3-58.dat MailPassView behavioral1/files/0x00070000000125a3-59.dat MailPassView behavioral1/files/0x00070000000125a3-60.dat MailPassView behavioral1/memory/1844-67-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1844-69-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/files/0x00070000000125a3-75.dat MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x00070000000125a3-58.dat WebBrowserPassView behavioral1/files/0x00070000000125a3-59.dat WebBrowserPassView behavioral1/files/0x00070000000125a3-60.dat WebBrowserPassView behavioral1/memory/1492-70-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1492-72-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/files/0x00070000000125a3-75.dat WebBrowserPassView -
Nirsoft 8 IoCs
resource yara_rule behavioral1/files/0x00070000000125a3-58.dat Nirsoft behavioral1/files/0x00070000000125a3-59.dat Nirsoft behavioral1/files/0x00070000000125a3-60.dat Nirsoft behavioral1/memory/1844-67-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1844-69-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1492-70-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1492-72-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/files/0x00070000000125a3-75.dat Nirsoft -
Executes dropped EXE 1 IoCs
pid Process 760 Windows Update.exe -
Deletes itself 1 IoCs
pid Process 760 Windows Update.exe -
Loads dropped DLL 2 IoCs
pid Process 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 1616 dw20.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 whatismyipaddress.com 7 whatismyipaddress.com 4 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 760 set thread context of 1844 760 Windows Update.exe 29 PID 760 set thread context of 1492 760 Windows Update.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 760 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 760 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 760 Windows Update.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 1212 wrote to memory of 760 1212 0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe 27 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1844 760 Windows Update.exe 29 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1492 760 Windows Update.exe 30 PID 760 wrote to memory of 1616 760 Windows Update.exe 34 PID 760 wrote to memory of 1616 760 Windows Update.exe 34 PID 760 wrote to memory of 1616 760 Windows Update.exe 34 PID 760 wrote to memory of 1616 760 Windows Update.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe"C:\Users\Admin\AppData\Local\Temp\0b34a3b62a081aaf79b21e11c99e19cae47b59effa40361fb39d195997e92bc6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:1844
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵PID:1492
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4523⤵
- Loads dropped DLL
PID:1616
-
-