c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747

Analysis

max time kernel
166s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:24

Target

c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
Size

611KB
MD5

c50f5faa258a4ba17024d057656bd214
SHA1

0ae4b56b611fc62ddfc461c6c4f469fd70d34575
SHA256

c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747
SHA512

628f710a8545c10b9754eedcf5c37e9d7c51ec46fe9bf97caa6599d7d2de92ebe6ca36f7a1e50cbee00b209bae4aa542c3392ed67d74b5246ff0a7b574550663
SSDEEP

12288:Ou8ZNQ0jQHf12pngbTZTu8wv+KjjALK32G6Pu:L6Ngd26tu8C+KjcL22

Score

9^/10

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/880-135-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/880-135-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/880-135-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

77 whatismyipaddress.com

flow	ioc
77	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

description	pid	process	target process
PID 2080 set thread context of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

description pid process

Token: SeDebugPrivilege 2080 c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

description	pid	process
Token: SeDebugPrivilege	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

description	pid	process	target process
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
PID 2080 wrote to memory of 880	2080	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe	c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe

C:\Users\Admin\AppData\Local\Temp\c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe
"C:\Users\Admin\AppData\Local\Temp\c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe"
2⤵
PID:880

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\c84da41844f93cb56561c1190d9f9ddc1f5f732df4f7c9d7e8b1546bb93e3747.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/880-134-0x0000000000000000-mapping.dmp

Download
memory/880-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/880-138-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/880-139-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/2080-132-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/2080-133-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/2080-137-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download