Analysis
-
max time kernel
139s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10/03/2022, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe
Resource
win10v2004-en-20220113
General
-
Target
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe
-
Size
790KB
-
MD5
fb3b1255373cbb400b23242db5245398
-
SHA1
e53bf5c7e20363d2e5217fe72e3356372c550935
-
SHA256
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e
-
SHA512
e4a5832621897087d1e9d6a83bc9b725b80fce22bcbf70d383e7a19388aa3b661d77ea416e3e71a1d3fe70fe2565d6991d6807c2e180e9aca8b40f71cc4e06be
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
martinich22
Signatures
-
NirSoft MailPassView 12 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x0009000000012213-59.dat MailPassView behavioral1/files/0x0009000000012213-62.dat MailPassView behavioral1/files/0x0009000000012213-61.dat MailPassView behavioral1/files/0x0009000000012213-60.dat MailPassView behavioral1/files/0x0009000000012213-63.dat MailPassView behavioral1/files/0x0009000000012213-65.dat MailPassView behavioral1/files/0x0007000000012258-70.dat MailPassView behavioral1/files/0x0007000000012258-71.dat MailPassView behavioral1/files/0x0007000000012258-72.dat MailPassView behavioral1/memory/2020-78-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2020-81-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/files/0x0007000000012258-89.dat MailPassView -
NirSoft WebBrowserPassView 12 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x0009000000012213-59.dat WebBrowserPassView behavioral1/files/0x0009000000012213-62.dat WebBrowserPassView behavioral1/files/0x0009000000012213-61.dat WebBrowserPassView behavioral1/files/0x0009000000012213-60.dat WebBrowserPassView behavioral1/files/0x0009000000012213-63.dat WebBrowserPassView behavioral1/files/0x0009000000012213-65.dat WebBrowserPassView behavioral1/files/0x0007000000012258-70.dat WebBrowserPassView behavioral1/files/0x0007000000012258-71.dat WebBrowserPassView behavioral1/files/0x0007000000012258-72.dat WebBrowserPassView behavioral1/memory/1624-83-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1624-86-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/files/0x0007000000012258-89.dat WebBrowserPassView -
Nirsoft 14 IoCs
resource yara_rule behavioral1/files/0x0009000000012213-59.dat Nirsoft behavioral1/files/0x0009000000012213-62.dat Nirsoft behavioral1/files/0x0009000000012213-61.dat Nirsoft behavioral1/files/0x0009000000012213-60.dat Nirsoft behavioral1/files/0x0009000000012213-63.dat Nirsoft behavioral1/files/0x0009000000012213-65.dat Nirsoft behavioral1/files/0x0007000000012258-70.dat Nirsoft behavioral1/files/0x0007000000012258-71.dat Nirsoft behavioral1/files/0x0007000000012258-72.dat Nirsoft behavioral1/memory/2020-78-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2020-81-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1624-83-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1624-86-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/files/0x0007000000012258-89.dat Nirsoft -
Executes dropped EXE 2 IoCs
pid Process 1248 presentacion de proyecto.exe 1956 Windows Update.exe -
Loads dropped DLL 6 IoCs
pid Process 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 1248 presentacion de proyecto.exe 812 dw20.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1956 set thread context of 2020 1956 Windows Update.exe 31 PID 1956 set thread context of 1624 1956 Windows Update.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1956 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1956 Windows Update.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 268 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1956 Windows Update.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1248 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 28 PID 1904 wrote to memory of 1248 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 28 PID 1904 wrote to memory of 1248 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 28 PID 1904 wrote to memory of 1248 1904 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 28 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1248 wrote to memory of 1956 1248 presentacion de proyecto.exe 29 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 2020 1956 Windows Update.exe 31 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 1624 1956 Windows Update.exe 32 PID 1956 wrote to memory of 812 1956 Windows Update.exe 36 PID 1956 wrote to memory of 812 1956 Windows Update.exe 36 PID 1956 wrote to memory of 812 1956 Windows Update.exe 36 PID 1956 wrote to memory of 812 1956 Windows Update.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe"C:\Users\Admin\AppData\Local\Temp\6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\presentacion de proyecto.exe"C:\Users\Admin\AppData\Local\Temp\presentacion de proyecto.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
PID:2020
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"4⤵PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4484⤵
- Loads dropped DLL
PID:812
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:268