a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0

General

Target

a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe
Size

552KB
MD5

c3f34faef2bb748c182b97d07f2ac772
SHA1

48f9fecf2b1d56709677e8b5db1eb12ad21fdf77
SHA256

a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0
SHA512

01efc8c08d9f6fd8ee6ef24e520d1d3d08a47f8600cff5b565e8eddd0c693fc0fcb29630d14ca1d185c3ea50102cb7683706872070720aa86a1f61279b4f337e

Score

9^/10

Malware Config

Signatures

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1668-68-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1668-71-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-68-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1668-71-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe

description	pid	process	target process
PID 1500 set thread context of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc.exe

pid process

1668 vbc.exe
1668 vbc.exe
1668 vbc.exe
1668 vbc.exe
1668 vbc.exe

pid	process
1668	vbc.exe
1668	vbc.exe
1668	vbc.exe
1668	vbc.exe
1668	vbc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe

description	pid	process	target process
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe
PID 1500 wrote to memory of 1668	1500	a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe
"C:\Users\Admin\AppData\Local\Temp\a63d62a7566226f922c70cdda933c39cf565b974f4141ba6d5d10b5eee8c8af0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1F05.tmp"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1F05.tmp

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1500-54-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1500-55-0x0000000074CF0000-0x000000007529B000-memory.dmp

Filesize
5.7MB

Download
memory/1500-56-0x0000000074CF0000-0x000000007529B000-memory.dmp

Filesize
5.7MB

Download
memory/1500-57-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1668-58-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-60-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-62-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-66-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-68-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-71-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads