a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a

General

Target

a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
Size

611KB
MD5

2c0c2f28645426d70abf957183b1236b
SHA1

03c127db4c33c832d6290e3fe9f0231b581bf15b
SHA256

a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a
SHA512

2fca80690c763e0394cb3d99b04e415b03fb447b0273b2731f6d76eb704d4cd933429326a55ca9f6d8e8bd5d526d186d1fc4c5f18bb0e6b30bf0af77524fa56e
SSDEEP

12288:8YLDtsU9a/hWthf/W4mR8hL0N8aHy6VWJrb2FpH1cCyX/AbEgAHV76Pu:FDtsc6yfOLEL0Zy6siFV1cC6/Cy

Score

9^/10

Malware Config

Signatures

NirSoft MailPassView 6 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1784-60-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1784-61-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1784-62-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1784-63-0x000000000047EA7E-mapping.dmp	MailPassView
behavioral1/memory/1784-65-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1784-67-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1784-60-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1784-61-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1784-62-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1784-63-0x000000000047EA7E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1784-65-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1784-67-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1784-60-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1784-61-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1784-62-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1784-63-0x000000000047EA7E-mapping.dmp	Nirsoft
behavioral1/memory/1784-65-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1784-67-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyipaddress.com
6 whatismyipaddress.com

flow	ioc
4	whatismyipaddress.com
6	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

description	pid	process	target process
PID 1236 set thread context of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

description pid process

Token: SeDebugPrivilege 1236 a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

description	pid	process
Token: SeDebugPrivilege	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

description	pid	process	target process
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
PID 1236 wrote to memory of 1784	1236	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe	a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe

C:\Users\Admin\AppData\Local\Temp\a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
"C:\Users\Admin\AppData\Local\Temp\a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe
"C:\Users\Admin\AppData\Local\Temp\a7f9a59d211741eceea0c3bcd1b5fc8e4ebbe691cfb4024bcaf5328961b9127a.exe"
2⤵
PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1236-55-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1236-56-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1236-70-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1784-61-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-60-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-58-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-62-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-63-0x000000000047EA7E-mapping.dmp

Download
memory/1784-65-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-67-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-57-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1784-69-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1784-71-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads