Analysis
-
max time kernel
104s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:24
Static task
static1
Behavioral task
behavioral1
Sample
l0185766832020805.PDF.exe
Resource
win7-20220414-en
General
-
Target
l0185766832020805.PDF.exe
-
Size
704KB
-
MD5
97b7848d96c0c8597f343302ccb46c2d
-
SHA1
7d83dc7b96f9a1b7791410661b314cfd6812e8d9
-
SHA256
f530b8632c088e021b96196b12490d2b6c4e7d2ca04b03a8646cc4a45f8de36c
-
SHA512
7e5697f22a99f4b1388cc083689b63719c4c0bd4aa88b4c9724952c44ce9bfd677a0cbc916e03ff87b1dc607d89636962dc07a9ee088938ffbc84a0f1da45236
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/5040-136-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral2/memory/864-142-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/864-143-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/864-145-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/864-146-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/5040-136-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral2/memory/4812-147-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/4812-148-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4812-150-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4812-151-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 9 IoCs
Processes:
resource yara_rule behavioral2/memory/5040-136-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral2/memory/864-142-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/864-143-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/864-145-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/864-146-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4812-147-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4812-148-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4812-150-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4812-151-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
l0185766832020805.PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation l0185766832020805.PDF.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 whatismyipaddress.com 41 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
l0185766832020805.PDF.exel0185766832020805.PDF.exedescription pid process target process PID 1640 set thread context of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 5040 set thread context of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 set thread context of 4812 5040 l0185766832020805.PDF.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
l0185766832020805.PDF.exevbc.exel0185766832020805.PDF.exepid process 1640 l0185766832020805.PDF.exe 1640 l0185766832020805.PDF.exe 1640 l0185766832020805.PDF.exe 1640 l0185766832020805.PDF.exe 1640 l0185766832020805.PDF.exe 1640 l0185766832020805.PDF.exe 4812 vbc.exe 4812 vbc.exe 5040 l0185766832020805.PDF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
l0185766832020805.PDF.exel0185766832020805.PDF.exedescription pid process Token: SeDebugPrivilege 1640 l0185766832020805.PDF.exe Token: SeDebugPrivilege 5040 l0185766832020805.PDF.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
l0185766832020805.PDF.exel0185766832020805.PDF.exedescription pid process target process PID 1640 wrote to memory of 4476 1640 l0185766832020805.PDF.exe schtasks.exe PID 1640 wrote to memory of 4476 1640 l0185766832020805.PDF.exe schtasks.exe PID 1640 wrote to memory of 4476 1640 l0185766832020805.PDF.exe schtasks.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 1640 wrote to memory of 5040 1640 l0185766832020805.PDF.exe l0185766832020805.PDF.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 864 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe PID 5040 wrote to memory of 4812 5040 l0185766832020805.PDF.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\l0185766832020805.PDF.exe"C:\Users\Admin\AppData\Local\Temp\l0185766832020805.PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LDRDxeRluRmdiB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA28.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\l0185766832020805.PDF.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\l0185766832020805.PDF.exe.logFilesize
412B
MD5ad1c7f6525cfeb54c0487efd38b0e26c
SHA1ed3da94723ac7e3828a9e93d68418bb810592f3b
SHA2560a534a3d0fa82e6a427164c5f6e702cac7e4afc9967af9bc5ddba4f84ab33276
SHA51248d625e6be5391d91d95c2850226fe39bb2411cb72139797699cfe126e6b066182e83950a8ea67e63b64a66b0d45f58d8bc97cab0363d55c2fd88c0d1d28009c
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\tmpBA28.tmpFilesize
1KB
MD53ca4f19be0084200429be8d945f802e9
SHA1249509714e15247e3560cd62e9ae71a4702936c4
SHA256b55611ca57521d4baa9df1212a32a46afd4b7cd2c98fef5ba05b3c52af06c7fc
SHA512126c57171381b701de610e4fe0ba6ed876cc1c3e1f810753cb45e0fa2b3acaa2e1440730f662b73e1a07a9933f36f1246533576d3f493946125ea67d7eb4d5fe
-
memory/864-142-0x0000000000000000-mapping.dmp
-
memory/864-146-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/864-145-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/864-143-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1640-131-0x0000000004DE0000-0x0000000004E7C000-memory.dmpFilesize
624KB
-
memory/1640-132-0x0000000004F20000-0x0000000004FB2000-memory.dmpFilesize
584KB
-
memory/1640-130-0x0000000000020000-0x00000000000D6000-memory.dmpFilesize
728KB
-
memory/4476-133-0x0000000000000000-mapping.dmp
-
memory/4812-147-0x0000000000000000-mapping.dmp
-
memory/4812-148-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4812-150-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4812-151-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/5040-135-0x0000000000000000-mapping.dmp
-
memory/5040-141-0x00000000081A0000-0x0000000008206000-memory.dmpFilesize
408KB
-
memory/5040-140-0x0000000005100000-0x0000000005156000-memory.dmpFilesize
344KB
-
memory/5040-139-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/5040-138-0x0000000005480000-0x0000000005A24000-memory.dmpFilesize
5.6MB
-
memory/5040-136-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB