Analysis
-
max time kernel
138s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22/02/2022, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe
Resource
win10v2004-en-20220113
General
-
Target
0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe
-
Size
597KB
-
MD5
30fd2ec9012ade78a3b8576efe2face6
-
SHA1
71ead9bd3141349069ab3cbc617e7eeb5a6e5e12
-
SHA256
0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8
-
SHA512
1d432dc96947dfe858997b02c85d2aee5f220915b54b01380e458b1c3d027e49381d432f520199375f633b599002692441259735abe7e3e0bbe86388b0467c92
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x00070000000133c1-58.dat MailPassView behavioral1/files/0x00070000000133c1-59.dat MailPassView behavioral1/files/0x00070000000133c1-60.dat MailPassView behavioral1/memory/1872-67-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1872-69-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x00070000000133c1-58.dat WebBrowserPassView behavioral1/files/0x00070000000133c1-59.dat WebBrowserPassView behavioral1/files/0x00070000000133c1-60.dat WebBrowserPassView behavioral1/memory/1764-70-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1764-73-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral1/files/0x00070000000133c1-58.dat Nirsoft behavioral1/files/0x00070000000133c1-59.dat Nirsoft behavioral1/files/0x00070000000133c1-60.dat Nirsoft behavioral1/memory/1872-67-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1872-69-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1764-70-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1764-73-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
pid Process 1036 Windows Update.exe -
Deletes itself 1 IoCs
pid Process 1036 Windows Update.exe -
Loads dropped DLL 1 IoCs
pid Process 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 whatismyipaddress.com 4 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1036 set thread context of 1872 1036 Windows Update.exe 29 PID 1036 set thread context of 1764 1036 Windows Update.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1036 Windows Update.exe 1036 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1036 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1036 Windows Update.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 960 wrote to memory of 1036 960 0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe 27 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1872 1036 Windows Update.exe 29 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30 PID 1036 wrote to memory of 1764 1036 Windows Update.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe"C:\Users\Admin\AppData\Local\Temp\0aa92ee64c4607e8c8c21151ee4c970f09309f27467cb6ba4e075084c3ccbbd8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:1872
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵PID:1764
-
-