Analysis
-
max time kernel
191s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe
Resource
win7-20220414-en
General
-
Target
f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe
-
Size
1.6MB
-
MD5
c0667a36058e6659ea95f3f6250d8888
-
SHA1
39c3f6d43bd64566e06c9c2f35dbc9ccbb4a33db
-
SHA256
f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1
-
SHA512
a9a59e1487b8958d582f7c7e049ad7874329d2a9844797487f44f128a2247a67df1e86d5d1b7feadfe3af2df3a00927d0607126f378481eccb57f01509112062
Malware Config
Signatures
-
NirSoft MailPassView 7 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/1552-137-0x0000000000700000-0x0000000001700000-memory.dmp MailPassView behavioral2/memory/1552-138-0x0000000000782F9E-mapping.dmp MailPassView behavioral2/memory/1552-139-0x0000000000700000-0x0000000000788000-memory.dmp MailPassView behavioral2/memory/2900-147-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/2900-146-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/2900-149-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/2900-150-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1552-137-0x0000000000700000-0x0000000001700000-memory.dmp WebBrowserPassView behavioral2/memory/1552-138-0x0000000000782F9E-mapping.dmp WebBrowserPassView behavioral2/memory/1552-139-0x0000000000700000-0x0000000000788000-memory.dmp WebBrowserPassView behavioral2/memory/1952-151-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/1952-152-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1952-154-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1952-155-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 11 IoCs
Processes:
resource yara_rule behavioral2/memory/1552-137-0x0000000000700000-0x0000000001700000-memory.dmp Nirsoft behavioral2/memory/1552-138-0x0000000000782F9E-mapping.dmp Nirsoft behavioral2/memory/1552-139-0x0000000000700000-0x0000000000788000-memory.dmp Nirsoft behavioral2/memory/2900-147-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2900-146-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/2900-149-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2900-150-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1952-151-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/1952-152-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1952-154-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1952-155-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
Processes:
xndcummebt.exepid process 4236 xndcummebt.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation WScript.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
xndcummebt.exeRegSvcs.exedescription pid process target process PID 4236 set thread context of 1552 4236 xndcummebt.exe RegSvcs.exe PID 1552 set thread context of 2900 1552 RegSvcs.exe vbc.exe PID 1552 set thread context of 1952 1552 RegSvcs.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exeWScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xndcummebt.exeRegSvcs.exepid process 4236 xndcummebt.exe 4236 xndcummebt.exe 1552 RegSvcs.exe 1552 RegSvcs.exe 1552 RegSvcs.exe 1552 RegSvcs.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe 4236 xndcummebt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1552 RegSvcs.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exeWScript.exexndcummebt.exeRegSvcs.exedescription pid process target process PID 4324 wrote to memory of 4652 4324 f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe WScript.exe PID 4324 wrote to memory of 4652 4324 f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe WScript.exe PID 4324 wrote to memory of 4652 4324 f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe WScript.exe PID 4652 wrote to memory of 4236 4652 WScript.exe xndcummebt.exe PID 4652 wrote to memory of 4236 4652 WScript.exe xndcummebt.exe PID 4652 wrote to memory of 4236 4652 WScript.exe xndcummebt.exe PID 4236 wrote to memory of 1552 4236 xndcummebt.exe RegSvcs.exe PID 4236 wrote to memory of 1552 4236 xndcummebt.exe RegSvcs.exe PID 4236 wrote to memory of 1552 4236 xndcummebt.exe RegSvcs.exe PID 4236 wrote to memory of 1552 4236 xndcummebt.exe RegSvcs.exe PID 4236 wrote to memory of 1552 4236 xndcummebt.exe RegSvcs.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 2900 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe PID 1552 wrote to memory of 1952 1552 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe"C:\Users\Admin\AppData\Local\Temp\f9101503ea60a51ed3b8a8ac0281a28dda3aa268ed2ce37621492c1cd98144f1.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92945650\wukuih.vbe"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92945650\xndcummebt.exe"C:\Users\Admin\AppData\Local\Temp\92945650\xndcummebt.exe" cung.ktl3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\92945650\cung.ktlFilesize
251.6MB
MD51dd75cb84874aa24d5c03258080c6c57
SHA1d951970a3f18ac58474cfdf95991acf686bb5221
SHA256a9845d6ecb9eb504bf95c541933626834845153ca1cd1e9e77bd6122dfa419ec
SHA512ce0693535e4f8006934b77f22966e14d16224f06d787403c1ee3c7dabfebae9d28c32cab78cdfa4238df57b41c8724ac758b902707960613056e04b12b37793c
-
C:\Users\Admin\AppData\Local\Temp\92945650\nuqmfae.mp3Filesize
1.1MB
MD500a729b8b6773ffcd4b82336e60fa739
SHA1f6c3229e8cea70cb14e3223b5af83ff75e480bfb
SHA256ac0c0b2cf2afbd1fe759630a20945fe0bc1acd4841b759972c55a0e39a8b92d1
SHA5121a0ec08c4f5a2c888a9e87e32d31bec235b6f38dc4f06e59b7125b9e8dca4f3495343fed71ff7de8d89714cef2514b4f20845c232ad12f952eb399ba2fd62af6
-
C:\Users\Admin\AppData\Local\Temp\92945650\wukuih.vbeFilesize
28KB
MD50ce06d3c0ee00a09d05b5675ad1a27c2
SHA155d3281fd8ca4f49c688715342006d4818614e04
SHA2565e4fe7361ca5cebcfb4a5c9ac985b3d3a92ce2f032011b5b1ca7214570a6c20e
SHA51290b227af9bab2e1f19f3b76b76111d2ebcd7fdcbcd06c069e04fa7508ad57ee1787167b5c33dc5bb42f43cb8e522f618ba84ff2978c0d13bb15aa8a6142db111
-
C:\Users\Admin\AppData\Local\Temp\92945650\xndcummebt.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\Local\Temp\92945650\xndcummebt.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/1552-142-0x000000000BB60000-0x000000000BBF2000-memory.dmpFilesize
584KB
-
memory/1552-145-0x000000000EE80000-0x000000000EEE6000-memory.dmpFilesize
408KB
-
memory/1552-138-0x0000000000782F9E-mapping.dmp
-
memory/1552-139-0x0000000000700000-0x0000000000788000-memory.dmpFilesize
544KB
-
memory/1552-140-0x000000000B990000-0x000000000BA2C000-memory.dmpFilesize
624KB
-
memory/1552-141-0x000000000C070000-0x000000000C614000-memory.dmpFilesize
5.6MB
-
memory/1552-137-0x0000000000700000-0x0000000001700000-memory.dmpFilesize
16.0MB
-
memory/1552-143-0x000000000BA40000-0x000000000BA4A000-memory.dmpFilesize
40KB
-
memory/1552-144-0x000000000BAC0000-0x000000000BB16000-memory.dmpFilesize
344KB
-
memory/1952-151-0x0000000000000000-mapping.dmp
-
memory/1952-152-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1952-154-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1952-155-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2900-147-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2900-146-0x0000000000000000-mapping.dmp
-
memory/2900-149-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2900-150-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4236-133-0x0000000000000000-mapping.dmp
-
memory/4652-130-0x0000000000000000-mapping.dmp