Analysis
-
max time kernel
126s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 09:25
Static task
static1
Behavioral task
behavioral1
Sample
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe
Resource
win10v2004-20220414-en
General
-
Target
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe
-
Size
1.0MB
-
MD5
97a2ab1a919748de874d2420c6d138a1
-
SHA1
c052e8b275800fa00b1034743c0394ede191c0be
-
SHA256
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a
-
SHA512
b640e83dccbbb0f101898dd6e2599e5cb0d655ecc2d573aa7ed2395c6fb90a45d6582237981678d6a10a1d293eda240c2541bd6eb268553cc949f4a6b500a16f
Malware Config
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2980-148-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2980-150-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2980-151-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3648-141-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3648-143-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3648-144-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3648-145-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3648-141-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3648-143-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3648-144-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3648-145-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2980-148-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2980-150-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2980-151-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 33 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exee4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exedescription pid process target process PID 2508 set thread context of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 4252 set thread context of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 set thread context of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
vbc.exee4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exepid process 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 3648 vbc.exe 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exedescription pid process Token: SeDebugPrivilege 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exepid process 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exee4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exedescription pid process target process PID 2508 wrote to memory of 4444 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe schtasks.exe PID 2508 wrote to memory of 4444 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe schtasks.exe PID 2508 wrote to memory of 4444 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe schtasks.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 2508 wrote to memory of 4252 2508 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 3648 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe PID 4252 wrote to memory of 2980 4252 e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe"C:\Users\Admin\AppData\Local\Temp\e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jfXCYR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CD5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe"C:\Users\Admin\AppData\Local\Temp\e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp8CDE.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp958A.tmp"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\e4524474dc0dd7baf4474ec7700268311bda6eb1862a0c41c8e527acd761378a.exe.logFilesize
500B
MD5f3bfbe5958adfc86cc0ea0a8317ea113
SHA13bf76848af2edafcacee5f9fb6a06b35a6724015
SHA256598715cafd950c881e4fe318430b5830e95781f2093baa22f124cfad03320874
SHA512873fb9861d615ec3298ccba8231ea3f2a22f2050fe68fea1a6948987942c04f6b40f0b92d5e59f6971cdb429b67877ac2e3cfc953949a0140e03c6cdb8a1139d
-
C:\Users\Admin\AppData\Local\Temp\tmp5CD5.tmpFilesize
1KB
MD56eb2d327f444bd155989c07dd59e0421
SHA132decc56d8f6100d42923331329546c71eb99402
SHA256e87a60afe035fb6353d5e8bd38c823f0fdcee1a4d0ed3610c34c5100d526ef9a
SHA512e3c186857a63b910d620ca557e66541a12d1a22fe3a95fef4b6769a2c821d50ce43d8b61c445c7c6d1f1f9ef169e2c3d73761d5a9c2fb1d60f4812242527e8f8
-
C:\Users\Admin\AppData\Local\Temp\tmp8CDE.tmpFilesize
4KB
MD5bdf65f70610625cc771c5cc7ce168c7d
SHA1a8829b1c071ed0521d11925a98468c12a53a03b8
SHA256b66236dd86f140ca02db0c296e45032b272de2895c4f047a562e73bc8395dba5
SHA512add2db50b0440b07ecc48a5fde7f0b72e84b76f11ea060944afa28ddd03791e6adb3bfca704254131fb3f591f484b37f7276fab96b0c4776a27cb526bcf5f3a4
-
memory/2508-137-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/2508-130-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/2508-131-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/2980-151-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2980-147-0x0000000000000000-mapping.dmp
-
memory/2980-150-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2980-148-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3648-140-0x0000000000000000-mapping.dmp
-
memory/3648-141-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3648-143-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3648-144-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3648-145-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4252-134-0x0000000000000000-mapping.dmp
-
memory/4252-139-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/4252-138-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/4444-132-0x0000000000000000-mapping.dmp