358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153

General

Target

358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
Size

680KB
MD5

1313e10274a1ac0bd8535ac0f203107c
SHA1

0bb5259476cf3cd5ffd55e8f88b9bf56c8bda332
SHA256

358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153
SHA512

8d926bf24c858667fafe394d6a5128f10b869196fc212a88e7b9e500ff7ec3b753913feb605c3c9d50a5abd1727e880760a8d8f2d2e0dfc17134701c67c9579f

Score

9^/10

Malware Config

Signatures

NirSoft MailPassView 7 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1344-82-0x0000000000100000-0x0000000000188000-memory.dmp	MailPassView
behavioral1/memory/1344-87-0x0000000000100000-0x0000000000188000-memory.dmp	MailPassView
behavioral1/memory/1344-85-0x0000000000100000-0x0000000000188000-memory.dmp	MailPassView
behavioral1/memory/1344-89-0x0000000000480B9E-mapping.dmp	MailPassView
behavioral1/memory/1344-92-0x0000000000100000-0x0000000000188000-memory.dmp	MailPassView
behavioral1/memory/1344-96-0x0000000000100000-0x0000000000188000-memory.dmp	MailPassView
behavioral1/memory/1344-99-0x0000000000100000-0x0000000000188000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 7 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1344-82-0x0000000000100000-0x0000000000188000-memory.dmp	WebBrowserPassView
behavioral1/memory/1344-87-0x0000000000100000-0x0000000000188000-memory.dmp	WebBrowserPassView
behavioral1/memory/1344-85-0x0000000000100000-0x0000000000188000-memory.dmp	WebBrowserPassView
behavioral1/memory/1344-89-0x0000000000480B9E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1344-92-0x0000000000100000-0x0000000000188000-memory.dmp	WebBrowserPassView
behavioral1/memory/1344-96-0x0000000000100000-0x0000000000188000-memory.dmp	WebBrowserPassView
behavioral1/memory/1344-99-0x0000000000100000-0x0000000000188000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1344-82-0x0000000000100000-0x0000000000188000-memory.dmp	Nirsoft
behavioral1/memory/1344-87-0x0000000000100000-0x0000000000188000-memory.dmp	Nirsoft
behavioral1/memory/1344-85-0x0000000000100000-0x0000000000188000-memory.dmp	Nirsoft
behavioral1/memory/1344-89-0x0000000000480B9E-mapping.dmp	Nirsoft
behavioral1/memory/1344-92-0x0000000000100000-0x0000000000188000-memory.dmp	Nirsoft
behavioral1/memory/1344-96-0x0000000000100000-0x0000000000188000-memory.dmp	Nirsoft
behavioral1/memory/1344-99-0x0000000000100000-0x0000000000188000-memory.dmp	Nirsoft

Suspicious use of SetThreadContext 2 IoCs

Processes:

358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe

description	pid	process	target process
PID 2020 set thread context of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 1864 set thread context of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

944 schtasks.exe
884 schtasks.exe

pid	process
944	schtasks.exe
884	schtasks.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe

description	pid	process	target process
PID 2020 wrote to memory of 944	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 2020 wrote to memory of 944	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 2020 wrote to memory of 944	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 2020 wrote to memory of 944	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 2020 wrote to memory of 1864	2020	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
PID 1864 wrote to memory of 884	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 1864 wrote to memory of 884	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 1864 wrote to memory of 884	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 1864 wrote to memory of 884	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	schtasks.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe
PID 1864 wrote to memory of 1344	1864	358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
"C:\Users\Admin\AppData\Local\Temp\358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Update\horn" /XML "C:\Users\Admin\AppData\Local\Temp\z125"
2⤵
- Creates scheduled task(s)
PID:944

C:\Users\Admin\AppData\Local\Temp\358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe
"C:\Users\Admin\AppData\Local\Temp\358a233c1c093764cd0430f809b957e85b7b168c1b1a651ad542e5ae274bf153.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Update\bear" /XML "C:\Users\Admin\AppData\Local\Temp\z209"
3⤵
- Creates scheduled task(s)
PID:884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
3⤵
PID:1344

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\z125
Filesize
1KB

MD5
c30b59f0618e72bad57d785d507492c8

SHA1
e53c35b668ad37220320302433a2c4ebee894d4b

SHA256
f2012f0c92c33ce4f875e0539321b0c79ce3a68459b63e5967ca1a283103cad2

SHA512
5e5ed1fcd06f44908238257b743e248397aacadd9b69b12fcfc10e24554dd34bd7c7d8e12541a2e81f0b70dd4b5f40befb355b1fc4f7218c3c9145819c8b255b

Download Submit
C:\Users\Admin\AppData\Local\Temp\z209
Filesize
1KB

MD5
75a8d3dfc905aff688bb38cd762828dc

SHA1
a8628a0bff9aa76633280134cab442a6ac72a8c8

SHA256
8bb5900ece74060c918db2387ab209abb1b723c2813017db769f5a5f0bf50836

SHA512
a13407708a2408e5eeff97511e1291cd66141012c0193e20f566f0193951e740b63a4ccf494c819bf20879af4a7ea8f896ceca32636e9c4e69cfe2859148789a

Download Submit
memory/884-76-0x0000000000000000-mapping.dmp

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/1344-85-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-79-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-102-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download
memory/1344-101-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download
memory/1344-99-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-96-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-92-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-89-0x0000000000480B9E-mapping.dmp

Download
memory/1344-87-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-82-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1344-80-0x0000000000100000-0x0000000000188000-memory.dmp

Filesize
544KB

Download
memory/1864-71-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1864-59-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1864-60-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1864-62-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1864-75-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1864-73-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1864-66-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1864-78-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1864-90-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1864-68-0x0000000000497D3E-mapping.dmp

Download
memory/2020-70-0x0000000074C20000-0x00000000751CB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000074C20000-0x00000000751CB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-55-0x0000000074C20000-0x00000000751CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads