Analysis
-
max time kernel
104s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 20:33
Static task
static1
Behavioral task
behavioral1
Sample
4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe
Resource
win10v2004-20220414-en
General
-
Target
4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe
-
Size
906KB
-
MD5
6f44e365d71e852639c9674933814fca
-
SHA1
20a2ad6ba80fec51f9eafd56bb4e1d6d6ea09f5f
-
SHA256
4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37
-
SHA512
cfea2709b8aa9298f6e4a7c3baf8d51572ff40a24082c0090c72c1ce32e0911d46cc7ef3edb9a44d4be6bb4249136bcb78de108fbe22579c9ca02d02f5b5296d
Malware Config
Signatures
-
NirSoft MailPassView 10 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/1808-68-0x000000000047EABE-mapping.dmp MailPassView behavioral1/memory/1808-71-0x00000000000E0000-0x0000000000164000-memory.dmp MailPassView behavioral1/memory/1808-70-0x00000000000E0000-0x0000000000164000-memory.dmp MailPassView behavioral1/memory/1808-75-0x00000000000E0000-0x0000000000164000-memory.dmp MailPassView behavioral1/memory/1808-78-0x00000000000E0000-0x0000000000164000-memory.dmp MailPassView behavioral1/memory/976-81-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/976-82-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/976-85-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/976-87-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/976-94-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 10 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/1808-68-0x000000000047EABE-mapping.dmp WebBrowserPassView behavioral1/memory/1808-71-0x00000000000E0000-0x0000000000164000-memory.dmp WebBrowserPassView behavioral1/memory/1808-70-0x00000000000E0000-0x0000000000164000-memory.dmp WebBrowserPassView behavioral1/memory/1808-75-0x00000000000E0000-0x0000000000164000-memory.dmp WebBrowserPassView behavioral1/memory/1808-78-0x00000000000E0000-0x0000000000164000-memory.dmp WebBrowserPassView behavioral1/memory/1148-88-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1148-89-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1148-92-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1148-93-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1148-96-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 15 IoCs
resource yara_rule behavioral1/memory/1808-68-0x000000000047EABE-mapping.dmp Nirsoft behavioral1/memory/1808-71-0x00000000000E0000-0x0000000000164000-memory.dmp Nirsoft behavioral1/memory/1808-70-0x00000000000E0000-0x0000000000164000-memory.dmp Nirsoft behavioral1/memory/1808-75-0x00000000000E0000-0x0000000000164000-memory.dmp Nirsoft behavioral1/memory/1808-78-0x00000000000E0000-0x0000000000164000-memory.dmp Nirsoft behavioral1/memory/976-81-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/976-82-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/976-85-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/976-87-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1148-88-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1148-89-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1148-92-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1148-93-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/976-94-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1148-96-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
pid Process 1452 project6392.exe 1808 project6392.exe -
Loads dropped DLL 1 IoCs
pid Process 1940 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Desktop\\project6392.exe -boot" project6392.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" project6392.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1452 set thread context of 1808 1452 project6392.exe 33 PID 1808 set thread context of 976 1808 project6392.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe Token: SeDebugPrivilege 1452 project6392.exe Token: SeDebugPrivilege 1808 project6392.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1808 project6392.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1820 wrote to memory of 956 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 27 PID 1820 wrote to memory of 956 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 27 PID 1820 wrote to memory of 956 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 27 PID 1820 wrote to memory of 956 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 27 PID 1820 wrote to memory of 1940 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 29 PID 1820 wrote to memory of 1940 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 29 PID 1820 wrote to memory of 1940 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 29 PID 1820 wrote to memory of 1940 1820 4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe 29 PID 1940 wrote to memory of 1452 1940 cmd.exe 31 PID 1940 wrote to memory of 1452 1940 cmd.exe 31 PID 1940 wrote to memory of 1452 1940 cmd.exe 31 PID 1940 wrote to memory of 1452 1940 cmd.exe 31 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1452 wrote to memory of 1808 1452 project6392.exe 33 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35 PID 1808 wrote to memory of 976 1808 project6392.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe"C:\Users\Admin\AppData\Local\Temp\4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\4d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37.exe" "C:\Users\Admin\Desktop\project6392.exe"2⤵PID:956
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\project6392.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\Desktop\project6392.exe"C:\Users\Admin\Desktop\project6392.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\Desktop\project6392.exe"C:\Users\Admin\Desktop\project6392.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
PID:976
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵PID:1148
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
906KB
MD56f44e365d71e852639c9674933814fca
SHA120a2ad6ba80fec51f9eafd56bb4e1d6d6ea09f5f
SHA2564d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37
SHA512cfea2709b8aa9298f6e4a7c3baf8d51572ff40a24082c0090c72c1ce32e0911d46cc7ef3edb9a44d4be6bb4249136bcb78de108fbe22579c9ca02d02f5b5296d
-
Filesize
906KB
MD56f44e365d71e852639c9674933814fca
SHA120a2ad6ba80fec51f9eafd56bb4e1d6d6ea09f5f
SHA2564d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37
SHA512cfea2709b8aa9298f6e4a7c3baf8d51572ff40a24082c0090c72c1ce32e0911d46cc7ef3edb9a44d4be6bb4249136bcb78de108fbe22579c9ca02d02f5b5296d
-
Filesize
906KB
MD56f44e365d71e852639c9674933814fca
SHA120a2ad6ba80fec51f9eafd56bb4e1d6d6ea09f5f
SHA2564d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37
SHA512cfea2709b8aa9298f6e4a7c3baf8d51572ff40a24082c0090c72c1ce32e0911d46cc7ef3edb9a44d4be6bb4249136bcb78de108fbe22579c9ca02d02f5b5296d
-
Filesize
906KB
MD56f44e365d71e852639c9674933814fca
SHA120a2ad6ba80fec51f9eafd56bb4e1d6d6ea09f5f
SHA2564d9bc018fa90f713b3489a501f676ee87d975f0466a6e9f63dffd81513fa7a37
SHA512cfea2709b8aa9298f6e4a7c3baf8d51572ff40a24082c0090c72c1ce32e0911d46cc7ef3edb9a44d4be6bb4249136bcb78de108fbe22579c9ca02d02f5b5296d