Overview

overview

9

Static

static

57dec4bc69...85.exe

windows7-x64

9

57dec4bc69...85.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57dec4bc69b77b52520e3d476e39949f0be803647a70f7d00ecd15be08035185

  • Size

    605KB

  • Sample

    220724-x6x3jsdgfq

  • MD5

    15a3c7858edf89cc13ab89c431c1c3a6

  • SHA1

    e0cef058068d5301afcb16ead6e751b540b403c3

  • SHA256

    57dec4bc69b77b52520e3d476e39949f0be803647a70f7d00ecd15be08035185

  • SHA512

    20025bfc2bb8d99f56ee1edeaa03ee61ef52a131e764e36046b87578813cde2a101727d6e2cb4404ac0b7a770fe43116e5b0b4918bcca3d9e758be900b905222

Score
9/10
collection

Malware Config

Targets

    • Target

      57dec4bc69b77b52520e3d476e39949f0be803647a70f7d00ecd15be08035185

    • Size

      605KB

    • MD5

      15a3c7858edf89cc13ab89c431c1c3a6

    • SHA1

      e0cef058068d5301afcb16ead6e751b540b403c3

    • SHA256

      57dec4bc69b77b52520e3d476e39949f0be803647a70f7d00ecd15be08035185

    • SHA512

      20025bfc2bb8d99f56ee1edeaa03ee61ef52a131e764e36046b87578813cde2a101727d6e2cb4404ac0b7a770fe43116e5b0b4918bcca3d9e758be900b905222

    Score
    9/10
    collection

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks