Analysis
-
max time kernel
183s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 03:54
Static task
static1
Behavioral task
behavioral1
Sample
3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe
Resource
win7-20220414-en
General
-
Target
3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe
-
Size
1.0MB
-
MD5
0430cba35d87de27d643d6e7583b1f8a
-
SHA1
dd860a2adcdd147d85d395ae0df32213118a40ea
-
SHA256
3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746
-
SHA512
6d512b25b91a6a24d0eb6e16ca5a51a06181c77ea23f90870b26bce4f59166f0ccb933969806ba6eed9ecb365310776f60326a13a1e6cee4f8b74b9ab9824fe8
Malware Config
Signatures
-
NirSoft MailPassView 11 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1472-66-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1472-68-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1472-69-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1472-70-0x000000000047EF8E-mapping.dmp MailPassView behavioral1/memory/1472-72-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1472-74-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1748-78-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1748-79-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1748-82-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1748-85-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1748-86-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 10 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1472-66-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1472-68-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1472-69-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1472-70-0x000000000047EF8E-mapping.dmp WebBrowserPassView behavioral1/memory/1472-72-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1472-74-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/2044-87-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/2044-88-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/2044-91-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/2044-94-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 15 IoCs
Processes:
resource yara_rule behavioral1/memory/1472-66-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1472-68-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1472-69-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1472-70-0x000000000047EF8E-mapping.dmp Nirsoft behavioral1/memory/1472-72-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1472-74-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1748-78-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1748-79-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1748-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1748-85-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1748-86-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2044-87-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/2044-88-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/2044-91-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/2044-94-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
Processes:
tmjBp.exepid process 1340 tmjBp.exe -
Loads dropped DLL 4 IoCs
Processes:
3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exepid process 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
tmjBp.exedescription ioc process File opened (read-only) \??\e: tmjBp.exe File opened (read-only) \??\g: tmjBp.exe File opened (read-only) \??\l: tmjBp.exe File opened (read-only) \??\o: tmjBp.exe File opened (read-only) \??\p: tmjBp.exe File opened (read-only) \??\q: tmjBp.exe File opened (read-only) \??\s: tmjBp.exe File opened (read-only) \??\b: tmjBp.exe File opened (read-only) \??\u: tmjBp.exe File opened (read-only) \??\j: tmjBp.exe File opened (read-only) \??\t: tmjBp.exe File opened (read-only) \??\x: tmjBp.exe File opened (read-only) \??\f: tmjBp.exe File opened (read-only) \??\i: tmjBp.exe File opened (read-only) \??\k: tmjBp.exe File opened (read-only) \??\m: tmjBp.exe File opened (read-only) \??\w: tmjBp.exe File opened (read-only) \??\y: tmjBp.exe File opened (read-only) \??\z: tmjBp.exe File opened (read-only) \??\a: tmjBp.exe File opened (read-only) \??\n: tmjBp.exe File opened (read-only) \??\r: tmjBp.exe File opened (read-only) \??\v: tmjBp.exe File opened (read-only) \??\h: tmjBp.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\mLy62Uv\tmjBp.exe autoit_exe \Users\Admin\mLy62Uv\tmjBp.exe autoit_exe \Users\Admin\mLy62Uv\tmjBp.exe autoit_exe \Users\Admin\mLy62Uv\tmjBp.exe autoit_exe C:\Users\Admin\mLy62Uv\tmjBp.exe autoit_exe C:\Users\Admin\mLy62Uv\tmjBp.exe autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmjBp.exeRegSvcs.exedescription pid process target process PID 1340 set thread context of 1472 1340 tmjBp.exe RegSvcs.exe PID 1472 set thread context of 1748 1472 RegSvcs.exe vbc.exe PID 1472 set thread context of 2044 1472 RegSvcs.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
tmjBp.exeRegSvcs.exepid process 1340 tmjBp.exe 1472 RegSvcs.exe 1472 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1472 RegSvcs.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exetmjBp.exeRegSvcs.exedescription pid process target process PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1260 wrote to memory of 1340 1260 3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe tmjBp.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1340 wrote to memory of 1472 1340 tmjBp.exe RegSvcs.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 1748 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe PID 1472 wrote to memory of 2044 1472 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe"C:\Users\Admin\AppData\Local\Temp\3d33eeeee5c2c440509fe4d19b9a59c2e4a718339c500283a78f62b777a45746.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\mLy62Uv\tmjBp.exe"C:\Users\Admin\mLy62Uv\tmjBp.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\mLy62Uv\tmjBp.exeFilesize
1.3MB
MD523cfc4dd51a10cfc19c3e26d135e5f3f
SHA1c64c03fb635c7d243d4c4ad2d1dbf23f5871b037
SHA256a2a378c8984d2a3527c0622aad17e98b26154c8b07f146069b9137286cc1d206
SHA5120841ef1ed71bef927cbd5e1fa035c444ecb1ebc76009e6d51b506aeb1655e1e4744767afeafc44a210ca1b8f3a3ad82b63e386d72fd603773ca95a66856b392d
-
C:\Users\Admin\mLy62Uv\tmjBp.exeFilesize
1.3MB
MD523cfc4dd51a10cfc19c3e26d135e5f3f
SHA1c64c03fb635c7d243d4c4ad2d1dbf23f5871b037
SHA256a2a378c8984d2a3527c0622aad17e98b26154c8b07f146069b9137286cc1d206
SHA5120841ef1ed71bef927cbd5e1fa035c444ecb1ebc76009e6d51b506aeb1655e1e4744767afeafc44a210ca1b8f3a3ad82b63e386d72fd603773ca95a66856b392d
-
\Users\Admin\mLy62Uv\tmjBp.exeFilesize
1.3MB
MD523cfc4dd51a10cfc19c3e26d135e5f3f
SHA1c64c03fb635c7d243d4c4ad2d1dbf23f5871b037
SHA256a2a378c8984d2a3527c0622aad17e98b26154c8b07f146069b9137286cc1d206
SHA5120841ef1ed71bef927cbd5e1fa035c444ecb1ebc76009e6d51b506aeb1655e1e4744767afeafc44a210ca1b8f3a3ad82b63e386d72fd603773ca95a66856b392d
-
\Users\Admin\mLy62Uv\tmjBp.exeFilesize
1.3MB
MD523cfc4dd51a10cfc19c3e26d135e5f3f
SHA1c64c03fb635c7d243d4c4ad2d1dbf23f5871b037
SHA256a2a378c8984d2a3527c0622aad17e98b26154c8b07f146069b9137286cc1d206
SHA5120841ef1ed71bef927cbd5e1fa035c444ecb1ebc76009e6d51b506aeb1655e1e4744767afeafc44a210ca1b8f3a3ad82b63e386d72fd603773ca95a66856b392d
-
\Users\Admin\mLy62Uv\tmjBp.exeFilesize
1.3MB
MD523cfc4dd51a10cfc19c3e26d135e5f3f
SHA1c64c03fb635c7d243d4c4ad2d1dbf23f5871b037
SHA256a2a378c8984d2a3527c0622aad17e98b26154c8b07f146069b9137286cc1d206
SHA5120841ef1ed71bef927cbd5e1fa035c444ecb1ebc76009e6d51b506aeb1655e1e4744767afeafc44a210ca1b8f3a3ad82b63e386d72fd603773ca95a66856b392d
-
\Users\Admin\mLy62Uv\tmjBp.exeFilesize
1.3MB
MD523cfc4dd51a10cfc19c3e26d135e5f3f
SHA1c64c03fb635c7d243d4c4ad2d1dbf23f5871b037
SHA256a2a378c8984d2a3527c0622aad17e98b26154c8b07f146069b9137286cc1d206
SHA5120841ef1ed71bef927cbd5e1fa035c444ecb1ebc76009e6d51b506aeb1655e1e4744767afeafc44a210ca1b8f3a3ad82b63e386d72fd603773ca95a66856b392d
-
memory/1260-54-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1340-59-0x0000000000000000-mapping.dmp
-
memory/1472-72-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1472-84-0x0000000000586000-0x0000000000597000-memory.dmpFilesize
68KB
-
memory/1472-68-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1472-69-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1472-70-0x000000000047EF8E-mapping.dmp
-
memory/1472-64-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1472-74-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1472-76-0x00000000747B0000-0x0000000074D5B000-memory.dmpFilesize
5.7MB
-
memory/1472-77-0x00000000747B0000-0x0000000074D5B000-memory.dmpFilesize
5.7MB
-
memory/1472-95-0x0000000000586000-0x0000000000597000-memory.dmpFilesize
68KB
-
memory/1472-63-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1472-66-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1748-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1748-85-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1748-86-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1748-79-0x0000000000411654-mapping.dmp
-
memory/1748-78-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2044-87-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2044-88-0x0000000000442628-mapping.dmp
-
memory/2044-91-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2044-94-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB