Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:32
Static task
static1
Behavioral task
behavioral1
Sample
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe
Resource
win10v2004-20220901-en
General
-
Target
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe
-
Size
627KB
-
MD5
c0dbf7da39a106dd0bd52425ecc7c7fb
-
SHA1
2e3e1013e2c37b2e494b1d21fad30535e0c95c56
-
SHA256
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
-
SHA512
7573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
SSDEEP
12288:DHGMlyPzdD0cxpxX7/cTb8rMpyRZfMgoCvUFhi:bqPL1rgAYuZL
Malware Config
Signatures
-
NirSoft MailPassView 7 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1080-111-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1080-110-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1080-114-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1080-115-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1080-117-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/856-167-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/856-171-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
Nirsoft 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1076-95-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/1076-96-0x000000000040E758-mapping.dmp Nirsoft behavioral1/memory/1076-99-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/1076-100-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/1080-111-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1080-110-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1080-114-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1080-115-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1080-117-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/388-152-0x000000000040E758-mapping.dmp Nirsoft behavioral1/memory/388-155-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/388-156-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/856-167-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/856-171-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
WUDHost.exeAcctres.exeWUDHost.exeAcctres.exepid process 1164 WUDHost.exe 832 Acctres.exe 1488 WUDHost.exe 644 Acctres.exe -
Drops startup file 4 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acctres.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acctres.exe cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exeWUDHost.exedw20.exepid process 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1756 dw20.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
Processes:
vbc.exevbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WUDHost.exeWUDHost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 6 IoCs
Processes:
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exeAcctres.exeAcctres.exedescription pid process target process PID 1900 set thread context of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1784 set thread context of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 set thread context of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 832 set thread context of 644 832 Acctres.exe Acctres.exe PID 644 set thread context of 388 644 Acctres.exe vbc.exe PID 644 set thread context of 856 644 Acctres.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exeWUDHost.exepid process 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1164 WUDHost.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exeWUDHost.exeAcctres.exeAcctres.exeWUDHost.exedescription pid process Token: SeDebugPrivilege 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe Token: SeDebugPrivilege 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe Token: SeDebugPrivilege 1164 WUDHost.exe Token: SeDebugPrivilege 832 Acctres.exe Token: SeDebugPrivilege 644 Acctres.exe Token: SeDebugPrivilege 1488 WUDHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exeAcctres.exepid process 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 644 Acctres.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exeWUDHost.exeAcctres.exeAcctres.exedescription pid process target process PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1784 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe PID 1900 wrote to memory of 1164 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1900 wrote to memory of 1164 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1900 wrote to memory of 1164 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1900 wrote to memory of 1164 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1784 wrote to memory of 1532 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe cmd.exe PID 1784 wrote to memory of 1532 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe cmd.exe PID 1784 wrote to memory of 1532 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe cmd.exe PID 1784 wrote to memory of 1532 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe cmd.exe PID 1784 wrote to memory of 2004 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe dw20.exe PID 1784 wrote to memory of 2004 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe dw20.exe PID 1784 wrote to memory of 2004 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe dw20.exe PID 1784 wrote to memory of 2004 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe dw20.exe PID 1164 wrote to memory of 832 1164 WUDHost.exe Acctres.exe PID 1164 wrote to memory of 832 1164 WUDHost.exe Acctres.exe PID 1164 wrote to memory of 832 1164 WUDHost.exe Acctres.exe PID 1164 wrote to memory of 832 1164 WUDHost.exe Acctres.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1076 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1784 wrote to memory of 1080 1784 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe vbc.exe PID 1900 wrote to memory of 1488 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1900 wrote to memory of 1488 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1900 wrote to memory of 1488 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 1900 wrote to memory of 1488 1900 8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe WUDHost.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 832 wrote to memory of 644 832 Acctres.exe Acctres.exe PID 644 wrote to memory of 1216 644 Acctres.exe cmd.exe PID 644 wrote to memory of 1216 644 Acctres.exe cmd.exe PID 644 wrote to memory of 1216 644 Acctres.exe cmd.exe PID 644 wrote to memory of 1216 644 Acctres.exe cmd.exe PID 644 wrote to memory of 1756 644 Acctres.exe dw20.exe PID 644 wrote to memory of 1756 644 Acctres.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"3⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 16763⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logff.txt3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logmail.txt3⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acctres.exe"5⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 16605⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logff.txt5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logmail.txt5⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\logff.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\logff.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
memory/388-155-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/388-152-0x000000000040E758-mapping.dmp
-
memory/388-156-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/644-129-0x000000000047055E-mapping.dmp
-
memory/644-137-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/644-142-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/832-116-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/832-86-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/832-83-0x0000000000000000-mapping.dmp
-
memory/856-167-0x0000000000411654-mapping.dmp
-
memory/856-171-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1076-92-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-90-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-100-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-99-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-88-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-93-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-95-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1076-96-0x000000000040E758-mapping.dmp
-
memory/1076-87-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1080-103-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-114-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-115-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-102-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-117-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-105-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-111-0x0000000000411654-mapping.dmp
-
memory/1080-110-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-108-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1080-107-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1164-118-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1164-70-0x0000000000000000-mapping.dmp
-
memory/1164-76-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1164-80-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1216-136-0x0000000000000000-mapping.dmp
-
memory/1488-141-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1488-119-0x0000000000000000-mapping.dmp
-
memory/1488-122-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1532-74-0x0000000000000000-mapping.dmp
-
memory/1756-138-0x0000000000000000-mapping.dmp
-
memory/1784-67-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1784-58-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1784-75-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1784-65-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1784-57-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1784-63-0x000000000047055E-mapping.dmp
-
memory/1784-79-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1784-62-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1784-61-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1784-60-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1900-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1900-56-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/1900-55-0x0000000074A00000-0x0000000074FAB000-memory.dmpFilesize
5.7MB
-
memory/2004-77-0x0000000000000000-mapping.dmp