Overview

overview

10

Static

static

c7656b3b75...1f.exe

windows7_x64

10

c7656b3b75...1f.exe

windows10-2004_x64

9

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 00:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f.exe

  • Size

    654KB

  • MD5

    f285eb9d4d77ae2b1f864d16bbe5dd38

  • SHA1

    3e98368e1be6c109a121fba18f51e123593e8adc

  • SHA256

    c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f

  • SHA512

    e461c53e583006eb8fdbf080db9ad731eed2a3e19dcde23f4244b47610bd6a684ddd7a9899fdc706b5968d3e89f0d6aea6ccb7a210c753396a35a1884f442a72

Score
9/10
collection

Malware Config

Signatures

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f.exe
    "C:\Users\Admin\AppData\Local\Temp\c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f.exe
      "C:\Users\Admin\AppData\Local\Temp\c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3552
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpA181.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:3940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\c7656b3b750d1f873f0aa330fc9c514403bce4e12eecf9028b5ed58818e0001f.exe.log
    Filesize

    500B

    MD5

    160ee0aa7ac71bf18a4a8a17eae6d075

    SHA1

    c874f317c3d77b739e3d6c60471801bff9f87971

    SHA256

    540c64bca451d41b3b1a6d822775115fe86bca5d54b7e762f01fcf2328d9ee3a

    SHA512

    5a0eac7f33127ef21958cb38b562df325863711e502a89ad3298dc979a55d5d4251cbf8f708a8008ba96a7088190ae2372e9d408e3ce04068b29ba21108a62cc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp9D69.tmp
    Filesize

    4KB

    MD5

    a44410c464bc23ac615f732de976447c

    SHA1

    e13bb8bfa077dd78dda795b3c21750f217ba4d36

    SHA256

    a1a6fab77bd9c6713b610b41cb025ba806b8fd64fb80b862e1c44ab2277545a6

    SHA512

    15e8af0f65161d9ffe068f10083bb2aebfa9be89a36ca6816853f05b58dd05ea46c5abd2f306a354b6ce9eeab20f26a900c6cf3233553bacf168dcbefb79e31a

    Download Submit

  • memory/2384-130-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3552-139-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/3552-135-0x0000000000000000-mapping.dmp

    Download

  • memory/3552-136-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/3552-138-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/3588-134-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3588-131-0x0000000000000000-mapping.dmp

    Download

  • memory/3940-142-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3940-144-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3940-145-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3940-141-0x0000000000000000-mapping.dmp

    Download