Analysis
-
max time kernel
186s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 16:40
Static task
static1
Behavioral task
behavioral1
Sample
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe
Resource
win7-20220715-en
General
-
Target
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe
-
Size
741KB
-
MD5
7563f26bececeda03204733e06cc06c3
-
SHA1
54e5f16147df489a2f1fd7a02cc496a5c334697c
-
SHA256
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019
-
SHA512
bf42b6ce06b5d1ad7ced233e838a264fb1d31914627b294a036d6d9346e76fd48d34dbf03e562c9b951d772e806e94c62dbef4743313fa226eddbc316f8ece7b
Malware Config
Signatures
-
NirSoft MailPassView 8 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/5032-135-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral2/memory/5032-137-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral2/memory/5032-136-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral2/memory/4756-142-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/4756-143-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4756-145-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4756-146-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4756-147-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/5032-135-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral2/memory/5032-137-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral2/memory/5032-136-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral2/memory/4936-148-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/4936-149-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4936-151-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4936-152-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4936-154-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 13 IoCs
Processes:
resource yara_rule behavioral2/memory/5032-135-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral2/memory/5032-137-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral2/memory/5032-136-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral2/memory/4756-142-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4756-143-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4756-145-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4756-146-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4756-147-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4936-148-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4936-149-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4936-151-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4936-152-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4936-154-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 whatismyipaddress.com 38 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exeRegAsm.exedescription pid process target process PID 1508 set thread context of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 5032 set thread context of 4756 5032 RegAsm.exe vbc.exe PID 5032 set thread context of 4936 5032 RegAsm.exe vbc.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
vbc.exeRegAsm.exepid process 4936 vbc.exe 4936 vbc.exe 5032 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exedw20.exedescription pid process Token: SeDebugPrivilege 5032 RegAsm.exe Token: SeRestorePrivilege 4300 dw20.exe Token: SeBackupPrivilege 4300 dw20.exe Token: SeBackupPrivilege 4300 dw20.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 5032 RegAsm.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exeRegAsm.exedescription pid process target process PID 1508 wrote to memory of 2132 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 1508 wrote to memory of 2132 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 1508 wrote to memory of 2132 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1508 wrote to memory of 5032 1508 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4756 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4936 5032 RegAsm.exe vbc.exe PID 5032 wrote to memory of 4300 5032 RegAsm.exe dw20.exe PID 5032 wrote to memory of 4300 5032 RegAsm.exe dw20.exe PID 5032 wrote to memory of 4300 5032 RegAsm.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe"C:\Users\Admin\AppData\Local\Temp\55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\VDFFSHBXCTFGHDNMBGKZXDDXNVMNCCXBGBNXJNCJM" /XML "C:\Users\Admin\AppData\Local\Temp\z36"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9843⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\z36Filesize
1KB
MD5da95da34b3bcde71c5002b9bee5e8251
SHA15729e1d84f9824b1ff47d57658146bd3cc99084e
SHA2561c04c004f938f91bd6d88c9bf3213fd2e5a8859252a95f63ec8cbda3a5799af1
SHA512d5e07e7770f920f82bee08991de6fa84f54a7884691af3b287ce2da442df7dfac0dea702dec194808f69e0f50eb266b600f92d821883e32423f9abb6a9c2f85c
-
memory/1508-131-0x0000000075570000-0x0000000075B21000-memory.dmpFilesize
5.7MB
-
memory/1508-139-0x0000000075570000-0x0000000075B21000-memory.dmpFilesize
5.7MB
-
memory/1508-130-0x0000000075570000-0x0000000075B21000-memory.dmpFilesize
5.7MB
-
memory/2132-132-0x0000000000000000-mapping.dmp
-
memory/4300-155-0x0000000000000000-mapping.dmp
-
memory/4756-142-0x0000000000000000-mapping.dmp
-
memory/4756-143-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4756-145-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4756-146-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4756-147-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4936-154-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4936-149-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4936-152-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4936-151-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4936-148-0x0000000000000000-mapping.dmp
-
memory/5032-135-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/5032-141-0x0000000075570000-0x0000000075B21000-memory.dmpFilesize
5.7MB
-
memory/5032-140-0x0000000075570000-0x0000000075B21000-memory.dmpFilesize
5.7MB
-
memory/5032-136-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/5032-137-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/5032-134-0x0000000000000000-mapping.dmp