Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
22-11-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe
Resource
win10v2004-20221111-en
General
-
Target
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe
-
Size
580KB
-
MD5
0484f772e045b1e8029d3cca90fea9c2
-
SHA1
4dc084088bbe3ce8b00c578282539f0efa125cb4
-
SHA256
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
-
SHA512
f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
SSDEEP
12288:r0Yyb5eyBc0I8aVbHtfu6oPFmz2JNQxi8WbxV450oM5B:r0/5fwxfGXJ+1uQVM
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
dknenltgrbejvytn
Signatures
-
NirSoft MailPassView 15 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1068-60-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1068-61-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1068-62-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1068-63-0x000000000047EA5E-mapping.dmp MailPassView behavioral1/memory/1068-65-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1068-67-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/996-79-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/996-78-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/996-82-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/996-84-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/996-91-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1612-109-0x000000000047EA5E-mapping.dmp MailPassView behavioral1/memory/1612-112-0x00000000000C0000-0x0000000000144000-memory.dmp MailPassView behavioral1/memory/1612-118-0x00000000000C0000-0x0000000000144000-memory.dmp MailPassView behavioral1/memory/1612-124-0x00000000000C0000-0x0000000000144000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 14 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1068-60-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1068-61-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1068-62-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1068-63-0x000000000047EA5E-mapping.dmp WebBrowserPassView behavioral1/memory/1068-65-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1068-67-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/528-92-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/528-93-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/528-96-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/528-98-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1612-109-0x000000000047EA5E-mapping.dmp WebBrowserPassView behavioral1/memory/1612-112-0x00000000000C0000-0x0000000000144000-memory.dmp WebBrowserPassView behavioral1/memory/1612-118-0x00000000000C0000-0x0000000000144000-memory.dmp WebBrowserPassView behavioral1/memory/1612-124-0x00000000000C0000-0x0000000000144000-memory.dmp WebBrowserPassView -
Nirsoft 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1068-60-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1068-61-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1068-62-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1068-63-0x000000000047EA5E-mapping.dmp Nirsoft behavioral1/memory/1068-65-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1068-67-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/996-79-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/996-78-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/996-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/996-84-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/996-91-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/528-92-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/528-93-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/528-96-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/528-98-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1612-109-0x000000000047EA5E-mapping.dmp Nirsoft behavioral1/memory/1612-112-0x00000000000C0000-0x0000000000144000-memory.dmp Nirsoft behavioral1/memory/1612-118-0x00000000000C0000-0x0000000000144000-memory.dmp Nirsoft behavioral1/memory/1612-124-0x00000000000C0000-0x0000000000144000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
WUDHost.exeAcctres.exeAcctres.exeWUDHost.exepid process 1416 WUDHost.exe 1984 Acctres.exe 1612 Acctres.exe 1768 WUDHost.exe -
Loads dropped DLL 3 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeWUDHost.exeAcctres.exepid process 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1984 Acctres.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
WUDHost.exeWUDHost.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeAcctres.exedescription pid process target process PID 1108 set thread context of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1068 set thread context of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 set thread context of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1984 set thread context of 1612 1984 Acctres.exe Acctres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeWUDHost.exepid process 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 1416 WUDHost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeWUDHost.exeAcctres.exeWUDHost.exedescription pid process Token: SeDebugPrivilege 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe Token: SeDebugPrivilege 1416 WUDHost.exe Token: SeDebugPrivilege 1984 Acctres.exe Token: SeDebugPrivilege 1768 WUDHost.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeWUDHost.exeAcctres.exedescription pid process target process PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1068 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 1108 wrote to memory of 1416 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 1108 wrote to memory of 1416 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 1108 wrote to memory of 1416 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 1108 wrote to memory of 1416 1108 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 996 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1416 wrote to memory of 1984 1416 WUDHost.exe Acctres.exe PID 1416 wrote to memory of 1984 1416 WUDHost.exe Acctres.exe PID 1416 wrote to memory of 1984 1416 WUDHost.exe Acctres.exe PID 1416 wrote to memory of 1984 1416 WUDHost.exe Acctres.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1068 wrote to memory of 528 1068 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1612 1984 Acctres.exe Acctres.exe PID 1984 wrote to memory of 1768 1984 Acctres.exe WUDHost.exe PID 1984 wrote to memory of 1768 1984 Acctres.exe WUDHost.exe PID 1984 wrote to memory of 1768 1984 Acctres.exe WUDHost.exe PID 1984 wrote to memory of 1768 1984 Acctres.exe WUDHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
memory/528-98-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/528-92-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/528-93-0x0000000000442628-mapping.dmp
-
memory/528-96-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/996-91-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/996-78-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/996-84-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/996-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/996-79-0x0000000000411654-mapping.dmp
-
memory/1068-69-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1068-57-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-77-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1068-76-0x0000000000515000-0x0000000000526000-memory.dmpFilesize
68KB
-
memory/1068-58-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-99-0x0000000000515000-0x0000000000526000-memory.dmpFilesize
68KB
-
memory/1068-60-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-61-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-62-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-67-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-65-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1068-63-0x000000000047EA5E-mapping.dmp
-
memory/1108-101-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1108-54-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1108-55-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1108-56-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1416-102-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1416-75-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1416-83-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1416-71-0x0000000000000000-mapping.dmp
-
memory/1612-126-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1612-109-0x000000000047EA5E-mapping.dmp
-
memory/1612-124-0x00000000000C0000-0x0000000000144000-memory.dmpFilesize
528KB
-
memory/1612-112-0x00000000000C0000-0x0000000000144000-memory.dmpFilesize
528KB
-
memory/1612-118-0x00000000000C0000-0x0000000000144000-memory.dmpFilesize
528KB
-
memory/1768-128-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1768-116-0x0000000000000000-mapping.dmp
-
memory/1768-127-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1984-100-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1984-87-0x0000000000000000-mapping.dmp
-
memory/1984-90-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB