b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905

General

Target

b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe
Size

260KB
MD5

3141c148863ac17d728a5c0ddc249085
SHA1

6f75e61485e90c9125e5cc4695f555f3f05c59e2
SHA256

b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905
SHA512

339e3ae89e16516576f0a78a4c1077bde199af7aedbc8680c723f8a1a7737277faa6191b7c8b576d5b9d96922d652bdcf3f9c421c3c8f7483639fe5af8f80dec

Score

9^/10

collection spyware stealer upx

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1112-67-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/memory/1112-67-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/956-56-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/956-59-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/956-60-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1112-63-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1112-66-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1112-67-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 set thread context of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 956	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	27
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30
PID 1096 wrote to memory of 1112	1096	b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe	30

C:\Users\Admin\AppData\Local\Temp\b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe
"C:\Users\Admin\AppData\Local\Temp\b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe
  /scomma "C:\Users\Admin\AppData\Local\Temp\HbXRGCOAVR.ini"
  2⤵
  PID:956
- C:\Users\Admin\AppData\Local\Temp\b74c6ae445f48ca157681d589a4ab3754de12ac3b6eff54334f81d91e3931905.exe
  /scomma "C:\Users\Admin\AppData\Local\Temp\JdfXDiK4F0.ini"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/956-58-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/956-59-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/956-60-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1112-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1112-66-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1112-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing