Analysis
-
max time kernel
4294211s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
10/03/2022, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe
Resource
win10v2004-en-20220113
General
-
Target
6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe
-
Size
617KB
-
MD5
d22158dbf229b4dd99a606be9c479c1a
-
SHA1
aecc92ca0361a94bb93a7b610026b26129d93c67
-
SHA256
6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74
-
SHA512
10d208ab4cb6413d7d79322dfa93a999822acbb1779a9b47d95473b9f134a554b7677d99051fee50a2a1ec9c621c56c21e96293c5e8c0c987f339b375ebbe955
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x00080000000126bf-57.dat MailPassView behavioral1/files/0x00080000000126bf-58.dat MailPassView behavioral1/files/0x00080000000126bf-59.dat MailPassView behavioral1/memory/980-64-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/980-67-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x00080000000126bf-57.dat WebBrowserPassView behavioral1/files/0x00080000000126bf-58.dat WebBrowserPassView behavioral1/files/0x00080000000126bf-59.dat WebBrowserPassView behavioral1/memory/1060-72-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1060-69-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral1/files/0x00080000000126bf-57.dat Nirsoft behavioral1/files/0x00080000000126bf-58.dat Nirsoft behavioral1/files/0x00080000000126bf-59.dat Nirsoft behavioral1/memory/980-64-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/980-67-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1060-72-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1060-69-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
pid Process 268 Windows Update.exe -
Deletes itself 1 IoCs
pid Process 268 Windows Update.exe -
Loads dropped DLL 1 IoCs
pid Process 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 268 set thread context of 980 268 Windows Update.exe 29 PID 268 set thread context of 1060 268 Windows Update.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe 268 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 268 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 268 Windows Update.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 1204 wrote to memory of 268 1204 6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe 27 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 980 268 Windows Update.exe 29 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30 PID 268 wrote to memory of 1060 268 Windows Update.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe"C:\Users\Admin\AppData\Local\Temp\6679c3b3401b491bd63cd0c6dd0e446de086eefe5a2b57d56c42198f233b4e74.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:980
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵PID:1060
-
-