d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4

Analysis

max time kernel
68s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
Size

275KB
MD5

2b3495ad4cbf384123977996f6716c01
SHA1

07ae40448e91ef57afcafae3583e0bec37abbce2
SHA256

d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4
SHA512

b5c2f072e1b86deccb1d09de2547bb2e248c3144e255c7d4f5cb4cd910310974f69cf2cbf88a0767852ae6fe230b0de70642f18bb7fb56a40e402d38ac2d12ee
SSDEEP

6144:ypmxR++UT/dwshMi1TQ+yBuFzQgqj2NHez2TfUXJ/8DCcqWiKYA:yoxR9UTV2i1U+yOsgqj2lC2I18DfqWdb

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2796-166-0x0000000000400000-0x000000000041A000-memory.dmp	MailPassView
behavioral2/memory/2796-168-0x0000000000400000-0x000000000041A000-memory.dmp	MailPassView

Nirsoft 10 IoCs

resource	yara_rule
behavioral2/memory/5044-143-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/5044-145-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/1220-159-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/1220-161-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/2796-166-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral2/memory/2796-168-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral2/memory/4808-183-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4808-185-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/2828-190-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft
behavioral2/memory/2828-192-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 set thread context of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 set thread context of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 set thread context of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 set thread context of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 set thread context of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 set thread context of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
5044	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
Token: SeDebugPrivilege	1220	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 5044	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	79
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 636	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	80
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 1220	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	81
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 2796	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	82
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4380	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	83
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 4808	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	84
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85
PID 632 wrote to memory of 2828	632	d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe	85

C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
"C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:636
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:4808
- C:\Users\Admin\AppData\Local\Temp\d0096416c0765f45433c330dbf3aaf7365e6016f9df633797b263f7761c6ddd4.exe
  /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
  2⤵
  PID:2828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.txt

Filesize
33B

MD5
fec8656dbc9772ee24163ae3d57f41d9

SHA1
4e82071ada9bdc0002decba8b18b22a6dfdd127d

SHA256
7a3295b2c8c4797b8e5b4616bcc19bca30266371a54666855cbc67d443a3e4f4

SHA512
7c5965e41515a34db05c442587607bb51b6a3a8662df39513474f0d12c1236d882989d8c8bc99d24be27531c0e0df76af8c4beaf45e041767ab6ba2c72fc9326

Download Submit
memory/632-133-0x0000000002280000-0x000000000228A000-memory.dmp

Filesize
40KB

Download
memory/632-193-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/636-150-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/636-147-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/636-148-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/636-149-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/636-153-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/636-154-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1220-157-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1220-161-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1220-159-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1220-158-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1220-156-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2796-166-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2796-164-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2796-165-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2796-168-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2796-163-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2828-192-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2828-188-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2828-189-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2828-187-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2828-190-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4380-170-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4380-171-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4380-172-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4380-173-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4380-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4380-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4808-181-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4808-182-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4808-183-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4808-185-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4808-180-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/5044-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5044-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5044-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5044-145-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5044-143-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download