Analysis
-
max time kernel
79s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:29
Static task
static1
Behavioral task
behavioral1
Sample
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe
Resource
win7-20220414-en
General
-
Target
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe
-
Size
556KB
-
MD5
e3638516b609eed8bfa8e5732e5eebba
-
SHA1
12c752d26dab93e1b10f81cca4c7bb5d45c7b654
-
SHA256
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482
-
SHA512
ef60515898834800b2b281bb3484591125c4e5f91487dd8e5f1c2e07226d64cb0739448d9a53f68a3e42ab5498cf721e4e55b0702135657f5d9974158d746984
Malware Config
Signatures
-
NirSoft MailPassView 11 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2020-61-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2020-63-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2020-64-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2020-70-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2020-68-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2020-65-0x0000000000480C1E-mapping.dmp MailPassView behavioral1/memory/1504-77-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1504-76-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1504-80-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1504-82-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1504-83-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 11 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2020-61-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2020-63-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2020-64-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2020-70-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2020-68-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2020-65-0x0000000000480C1E-mapping.dmp WebBrowserPassView behavioral1/memory/1460-85-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1460-84-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1460-88-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1460-89-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1460-91-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-61-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2020-63-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2020-64-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2020-70-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2020-68-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2020-65-0x0000000000480C1E-mapping.dmp Nirsoft behavioral1/memory/1504-77-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1504-76-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1504-80-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1504-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1504-83-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1460-85-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1460-84-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1460-88-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1460-89-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1460-91-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 2020 svhost.exe -
Loads dropped DLL 1 IoCs
Processes:
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exepid process 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exesvhost.exedescription pid process target process PID 624 set thread context of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 2020 set thread context of 1504 2020 svhost.exe vbc.exe PID 2020 set thread context of 1460 2020 svhost.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exesvhost.exepid process 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe 2020 svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exesvhost.exedescription pid process Token: SeDebugPrivilege 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe Token: SeDebugPrivilege 2020 svhost.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exesvhost.exedescription pid process target process PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 624 wrote to memory of 2020 624 4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe svhost.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1504 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe PID 2020 wrote to memory of 1460 2020 svhost.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe"C:\Users\Admin\AppData\Local\Temp\4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
85KB
MD52e5f1cf69f92392f8829fc9c9263ae9b
SHA197b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA25651985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
85KB
MD52e5f1cf69f92392f8829fc9c9263ae9b
SHA197b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA25651985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
85KB
MD52e5f1cf69f92392f8829fc9c9263ae9b
SHA197b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA25651985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883
-
memory/624-55-0x0000000074A30000-0x0000000074FDB000-memory.dmpFilesize
5.7MB
-
memory/624-56-0x0000000074A30000-0x0000000074FDB000-memory.dmpFilesize
5.7MB
-
memory/624-74-0x0000000074A30000-0x0000000074FDB000-memory.dmpFilesize
5.7MB
-
memory/624-54-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1460-91-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1460-84-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1460-85-0x0000000000442628-mapping.dmp
-
memory/1460-88-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1460-89-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1504-83-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1504-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1504-76-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1504-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1504-77-0x0000000000411654-mapping.dmp
-
memory/2020-73-0x0000000074A30000-0x0000000074FDB000-memory.dmpFilesize
5.7MB
-
memory/2020-75-0x0000000074A30000-0x0000000074FDB000-memory.dmpFilesize
5.7MB
-
memory/2020-65-0x0000000000480C1E-mapping.dmp
-
memory/2020-81-0x00000000003C5000-0x00000000003D6000-memory.dmpFilesize
68KB
-
memory/2020-68-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-70-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-64-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-63-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-61-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-59-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-58-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2020-92-0x00000000003C5000-0x00000000003D6000-memory.dmpFilesize
68KB