13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe
Size

1011KB
MD5

9e215a4006c9de471744aad90e1e6419
SHA1

528e2c068eb3aac763576d47a2e91cde99d7829c
SHA256

13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5
SHA512

448639a5673682d3a578608cb622517d98631841f1d74f35adc25caa4aa71d3380bc07b6aaf510ec581386765cde27141bbd9894de59e2798c33322d4a0ce747

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4120-156-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4120-158-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4120-159-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4120-160-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1128-149-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1128-151-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1128-152-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1128-153-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral2/memory/1128-149-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1128-151-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1128-152-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1128-153-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4120-156-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4120-158-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4120-159-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4120-160-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 3644 set thread context of 1128	3644	RegAsm.exe	91
PID 3644 set thread context of 4120	3644	RegAsm.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe
2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe
1128	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1012	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	88
PID 2212 wrote to memory of 1012	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	88
PID 2212 wrote to memory of 1012	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	88
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 2212 wrote to memory of 3644	2212	13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe	90
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 1128	3644	RegAsm.exe	91
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92
PID 3644 wrote to memory of 4120	3644	RegAsm.exe	92

C:\Users\Admin\AppData\Local\Temp\13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe
"C:\Users\Admin\AppData\Local\Temp\13a3753bc569a713cb3c9c97a9fbcebb5b9994fdf323c571caa4bc7466d5abf5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGwiUcRai" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8EB3.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1012
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2CE7.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1128
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp3535.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2CE7.tmp

Filesize
4KB

MD5
92b3d04dbcf7aa8eabb0096c55624068

SHA1
04a3b14a8f16bdd8a67f1b5d6be8c3db79c766c7

SHA256
84e388e2bbff6a229d99df8d7e0558e46e793106c2f3bb290c6acc06fe31fe9c

SHA512
fbd6a298b66e2117f68028cdf9fa1b3e441f87fa8a052ce1be628ae65116d5b2953cdc8117dce57e86475a75412b1a85f431eb0da6dd788ec5312d34ff71f9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8EB3.tmp

Filesize
1KB

MD5
a0a7cf3375e48c52f99e635977f7dd1e

SHA1
f3d8b9dafdd7156b43628a0bfebf0044834114d3

SHA256
557605e14d3a97990a47c25ec0d110b3d79e3c45a5c4a4bf7d592c34ba14f22c

SHA512
002cccbfe5f214ab0a42450ad02b62b1dee5328bb4e084f74e3d55b8d04e634f3551348802146d000de9059162dd701d68a2264d96bd40908105356b6b6891b9

Download Submit
memory/1128-153-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-149-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-152-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1128-151-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2212-131-0x0000000074200000-0x0000000074D00000-memory.dmp

Filesize
11.0MB

Download
memory/2212-132-0x0000000073970000-0x0000000074118000-memory.dmp

Filesize
7.7MB

Download
memory/2212-141-0x0000000074200000-0x0000000074D00000-memory.dmp

Filesize
11.0MB

Download
memory/2212-142-0x0000000073970000-0x0000000074118000-memory.dmp

Filesize
7.7MB

Download
memory/2212-134-0x0000000074200000-0x0000000074D00000-memory.dmp

Filesize
11.0MB

Download
memory/2212-140-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/2212-130-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/2212-135-0x0000000073970000-0x0000000074118000-memory.dmp

Filesize
7.7MB

Download
memory/2212-133-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/3644-144-0x0000000074200000-0x0000000074D00000-memory.dmp

Filesize
11.0MB

Download
memory/3644-147-0x0000000074200000-0x0000000074D00000-memory.dmp

Filesize
11.0MB

Download
memory/3644-146-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/3644-145-0x0000000073970000-0x0000000074118000-memory.dmp

Filesize
7.7MB

Download
memory/3644-143-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/4120-156-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4120-158-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4120-159-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4120-160-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download