Analysis
-
max time kernel
114s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
14-03-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe
Resource
win10v2004-20220310-en
General
-
Target
dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe
-
Size
3.5MB
-
MD5
7f10ce56ef7ceb389c5c7c70bd17a88e
-
SHA1
3f6516b45fe7bb24c1b36a3041d117a04b744651
-
SHA256
dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0
-
SHA512
74f8382e8fe4945bf42a86f49e78c6f629572c421e31e7f16d5ad9aaed4f87e0826c92561b947f5e8a9b3faa72dd9fddf147310b8e8448005b0907f7ea3231e0
Malware Config
Signatures
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4084-144-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 1 IoCs
resource yara_rule behavioral2/memory/4084-144-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
resource yara_rule behavioral2/memory/1836-136-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1836-138-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1836-139-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4084-141-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4084-143-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4084-144-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3484 set thread context of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 set thread context of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 1836 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 82 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83 PID 3484 wrote to memory of 4084 3484 dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe"C:\Users\Admin\AppData\Local\Temp\dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe/scomma "C:\Users\Admin\AppData\Local\Temp\n6wVDrpejn.ini"2⤵PID:1836
-
-
C:\Users\Admin\AppData\Local\Temp\dc774e92cfce5db8e59c941d1bf667c89b52ed6d9ff881d8029368fbb41175b0.exe/scomma "C:\Users\Admin\AppData\Local\Temp\zdWMTkplfG.ini"2⤵
- Accesses Microsoft Outlook accounts
PID:4084
-