67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
Size

403KB
MD5

325a4d49b0ac357c735ba31645a95478
SHA1

d9d62bcbd7a98146b8f453741f62e9d4bf7ca988
SHA256

67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0
SHA512

70a748ba868a44cdbfecb03cf852d60488ca011a55d560441ec5b0caa810bfeaa2c1ead05999b7caf68bea2251fe7d7966a2403e3432eaea7031674d34e85ee5
SSDEEP

12288:I+qGh5hKEdq54fmHVZ/plbvwHgW4ejvKL7N3JS7olV95Ke:IvGh54p54fyplMAW4ejOWcV95

Score

9^/10

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2312-135-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/2312-135-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2312-135-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

37 whatismyipaddress.com

flow	ioc
37	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

description	pid	process	target process
PID 4704 set thread context of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

description pid process

Token: SeDebugPrivilege 4704 67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

description	pid	process
Token: SeDebugPrivilege	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

description	pid	process	target process
PID 4704 wrote to memory of 5032	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	CMD.exe
PID 4704 wrote to memory of 5032	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	CMD.exe
PID 4704 wrote to memory of 5032	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	CMD.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
PID 4704 wrote to memory of 2312	4704	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe	67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe

C:\Users\Admin\AppData\Local\Temp\67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
"C:\Users\Admin\AppData\Local\Temp\67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:5032

C:\Users\Admin\AppData\Local\Temp\67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe
"C:\Users\Admin\AppData\Local\Temp\67e3f822cf4a4ac06d29a008b2b8ce4ca6f30fa5c99d85a6f3fff1bcb73253b0.exe"
2⤵
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-134-0x0000000000000000-mapping.dmp

Download
memory/2312-135-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2312-136-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2312-138-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4704-132-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4704-137-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/5032-133-0x0000000000000000-mapping.dmp

Download