Analysis
-
max time kernel
234s -
max time network
172s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2022 05:13
Static task
static1
Behavioral task
behavioral1
Sample
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe
Resource
win7-20220812-en
General
-
Target
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe
-
Size
473KB
-
MD5
18e1a962b365f75f8c7e7b3b1985f2a2
-
SHA1
6672f2dde2660b905c9c96c1042035819fc06408
-
SHA256
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9
-
SHA512
e98cb0e0fe2c0e4d0e2534f4f331e238cb3a3f80f772c4dc97d539346fa6d6a51b2d8c48320b0fd8452b5101ee1820a65ced1eee8f9c5d9a24e3c575f8418891
-
SSDEEP
12288:EPXqahuwJqPbKWA7FtUhUopAbm6rkpBcZvmbEAhQy:W6aGKTFKhrpWm6rFvWEAKy
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tasdanlar.com.tr - Port:
21 - Username:
[email protected] - Password:
T,N-5SD@]@26
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/444-287-0x0000000000411654-mapping.dmp MailPassView behavioral2/memory/444-332-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1612-335-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral2/memory/1612-380-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1612-385-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 5 IoCs
Processes:
resource yara_rule behavioral2/memory/444-287-0x0000000000411654-mapping.dmp Nirsoft behavioral2/memory/444-332-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1612-335-0x0000000000442628-mapping.dmp Nirsoft behavioral2/memory/1612-380-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1612-385-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 whatismyipaddress.com 9 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exedd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exedescription pid process target process PID 4220 set thread context of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4856 set thread context of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 set thread context of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exevbc.exedd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exepid process 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe 1612 vbc.exe 1612 vbc.exe 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exedd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exedescription pid process Token: SeDebugPrivilege 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe Token: SeDebugPrivilege 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exedd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exedescription pid process target process PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4220 wrote to memory of 4856 4220 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 444 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe PID 4856 wrote to memory of 1612 4856 dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe"C:\Users\Admin\AppData\Local\Temp\dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe"C:\Users\Admin\AppData\Local\Temp\dd7526e78e317b1bd3873e2536a6e87932f140743c89e80b4f99abf522e6c3f9.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/444-287-0x0000000000411654-mapping.dmp
-
memory/444-332-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1612-335-0x0000000000442628-mapping.dmp
-
memory/1612-380-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1612-385-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4220-147-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-123-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-119-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-120-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-121-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-152-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-122-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-124-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-125-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-153-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-127-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-128-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-129-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-130-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-131-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-132-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-133-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-134-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-135-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-136-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-137-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-139-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-138-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-140-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-141-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-142-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-143-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-145-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-144-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-146-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-117-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-148-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-149-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-150-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-116-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-118-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-126-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-154-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-155-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-156-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-157-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-159-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-158-0x0000000074120000-0x00000000746D0000-memory.dmpFilesize
5.7MB
-
memory/4220-160-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-161-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-162-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-163-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-164-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-165-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-166-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-167-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-168-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-169-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-170-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-172-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-171-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-173-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-174-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-175-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-176-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-177-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-178-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-179-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-180-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-186-0x0000000074120000-0x00000000746D0000-memory.dmpFilesize
5.7MB
-
memory/4220-151-0x0000000077DA0000-0x0000000077F2E000-memory.dmpFilesize
1.6MB
-
memory/4220-192-0x0000000074120000-0x00000000746D0000-memory.dmpFilesize
5.7MB
-
memory/4856-242-0x00000000741C0000-0x0000000074770000-memory.dmpFilesize
5.7MB
-
memory/4856-333-0x00000000741C0000-0x0000000074770000-memory.dmpFilesize
5.7MB