d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4

Analysis

max time kernel
61s
max time network
82s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
Size

275KB
MD5

2b3495ad4cbf384123977996f6716c01
SHA1

07ae40448e91ef57afcafae3583e0bec37abbce2
SHA256

d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4
SHA512

b5c2f072e1b86deccb1d09de2547bb2e248c3144e255c7d4f5cb4cd910310974f69cf2cbf88a0767852ae6fe230b0de70642f18bb7fb56a40e402d38ac2d12ee
SSDEEP

6144:ypmxR++UT/dwshMi1TQ+yBuFzQgqj2NHez2TfUXJ/8DCcqWiKYA:yoxR9UTV2i1U+yOsgqj2lC2I18DfqWdb

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1068-124-0x00000000004102B0-mapping.dmp	MailPassView

Nirsoft 9 IoCs

resource	yara_rule
behavioral1/memory/992-72-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral1/memory/992-74-0x0000000000410622-mapping.dmp	Nirsoft
behavioral1/memory/992-76-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral1/memory/1692-105-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/1692-107-0x000000000040B78A-mapping.dmp	Nirsoft
behavioral1/memory/1692-109-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/1068-124-0x00000000004102B0-mapping.dmp	Nirsoft
behavioral1/memory/1888-159-0x0000000000406A5C-mapping.dmp	Nirsoft
behavioral1/memory/1132-174-0x00000000004075AF-mapping.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 set thread context of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 set thread context of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 set thread context of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 set thread context of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 set thread context of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 set thread context of 1132	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	33

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
Token: SeDebugPrivilege	1692	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 992	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	27
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 2024	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	28
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1692	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	29
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1068	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	30
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1740	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	31
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1888	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	32
PID 836 wrote to memory of 1132	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	33
PID 836 wrote to memory of 1132	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	33
PID 836 wrote to memory of 1132	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	33
PID 836 wrote to memory of 1132	836	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	33

C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
"C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.txt

Filesize
33B

MD5
fec8656dbc9772ee24163ae3d57f41d9

SHA1
4e82071ada9bdc0002decba8b18b22a6dfdd127d

SHA256
7a3295b2c8c4797b8e5b4616bcc19bca30266371a54666855cbc67d443a3e4f4

SHA512
7c5965e41515a34db05c442587607bb51b6a3a8662df39513474f0d12c1236d882989d8c8bc99d24be27531c0e0df76af8c4beaf45e041767ab6ba2c72fc9326

Download Submit
memory/836-54-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/992-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/992-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/992-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/992-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/992-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/992-72-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/992-75-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/992-76-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1068-110-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1068-111-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1068-119-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1068-116-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1068-113-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1692-105-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-95-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-97-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-100-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-102-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-94-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-109-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1740-143-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1740-140-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2024-80-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-88-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-92-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-93-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-77-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-78-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-83-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download