b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4

General

Target

b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe
Size

553KB
MD5

492c4849d59e13aac0ebcdaf382e4cf9
SHA1

c288fd8b81bf04bf838a4fbedffe9a42b69b549e
SHA256

b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4
SHA512

228f3857811f8aed7b238d8fa9ba508a28a99d2044fe7efcc8aee29c648182c10ea7438023192f49f85eda61580049d2cdfbcead7643428695efaf172bb77468

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4872-140-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4872-142-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4872-143-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4780-133-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/4780-135-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/4780-136-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/4780-137-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/4780-133-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4780-135-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4780-136-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4780-137-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4872-140-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4872-142-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4872-143-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 set thread context of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4780	vbc.exe
4780	vbc.exe
4780	vbc.exe
4780	vbc.exe
1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe
1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4780	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	79
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80
PID 1760 wrote to memory of 4872	1760	b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe	80

C:\Users\Admin\AppData\Local\Temp\b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe
"C:\Users\Admin\AppData\Local\Temp\b4cffae6b5eea5f24a5199d427bb913f4a17c9184a5f836646048e85dc2729f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp69D6.tmp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp8463.tmp"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:4872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp69D6.tmp

Filesize
4KB

MD5
92b3d04dbcf7aa8eabb0096c55624068

SHA1
04a3b14a8f16bdd8a67f1b5d6be8c3db79c766c7

SHA256
84e388e2bbff6a229d99df8d7e0558e46e793106c2f3bb290c6acc06fe31fe9c

SHA512
fbd6a298b66e2117f68028cdf9fa1b3e441f87fa8a052ce1be628ae65116d5b2953cdc8117dce57e86475a75412b1a85f431eb0da6dd788ec5312d34ff71f9d1

Download Submit
memory/1760-130-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download
memory/1760-131-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download
memory/4780-133-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4780-135-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4780-136-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4780-137-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4872-140-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4872-142-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4872-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing