61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883

General

Target

61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe
Size

601KB
MD5

ebbb87ad6bc1e883c3132dc441007a7f
SHA1

41242ca1d3320a7098f45369c9121f55922031d3
SHA256

61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883
SHA512

c49c17fa87a125004a613d5a4e843130f681272c03b33d68941afea14c002edb03b2f4b5eaa19855175673d3f4442153669fa941ad28d66c2a2f02a1ddf31b76
SSDEEP

12288:0jtSuf3dL1knbJII0bTtxi+KgigXqTY4/4iPBdWZRqAFRJC24nVb1:AFdL1TDy0jqT/4iPBsCAdC2Ab

Score

10^/10

collection evasion spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
overcomer123

Signatures

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1512-92-0x0000000000411654-mapping.dmp	MailPassView
behavioral1/memory/1512-91-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1512-95-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1512-97-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1512-98-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

Nirsoft 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/976-73-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/976-74-0x000000000040E758-mapping.dmp	Nirsoft
behavioral1/memory/976-77-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/976-78-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/1512-92-0x0000000000411654-mapping.dmp	Nirsoft
behavioral1/memory/1512-91-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1512-95-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1512-97-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1512-98-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Official PO....exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Official PO....exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

Official PO....exe

pid process

1144 Official PO....exe

pid	process
1144	Official PO....exe

Loads dropped DLL 3 IoCs

Processes:

61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exedw20.exe

pid	process
1504	61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe
1504	61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe
740	dw20.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 bot.whatismyipaddress.com

flow	ioc
5	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

Official PO....exe

description	pid	process	target process
PID 1144 set thread context of 976	1144	Official PO....exe	vbc.exe
PID 1144 set thread context of 1512	1144	Official PO....exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Official PO....exe

pid process

1144 Official PO....exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Official PO....exe

description pid process

Token: SeDebugPrivilege 1144 Official PO....exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Official PO....exe

pid process

1144 Official PO....exe
1144 Official PO....exe

pid	process
1144	Official PO....exe

description	pid	process
Token: SeDebugPrivilege	1144	Official PO....exe

pid	process
1144	Official PO....exe
1144	Official PO....exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exeOfficial PO....exe

description	pid	process	target process
PID 1504 wrote to memory of 1144	1504	61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe	Official PO....exe
PID 1504 wrote to memory of 1144	1504	61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe	Official PO....exe
PID 1504 wrote to memory of 1144	1504	61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe	Official PO....exe
PID 1504 wrote to memory of 1144	1504	61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe	Official PO....exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 976	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 740	1144	Official PO....exe	dw20.exe
PID 1144 wrote to memory of 740	1144	Official PO....exe	dw20.exe
PID 1144 wrote to memory of 740	1144	Official PO....exe	dw20.exe
PID 1144 wrote to memory of 740	1144	Official PO....exe	dw20.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe
PID 1144 wrote to memory of 1512	1144	Official PO....exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe
"C:\Users\Admin\AppData\Local\Temp\61d4211283a55486a8d88d37bd4d6ca4743f0bb0ff306590d84675301c30e883.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\Official PO....exe
"C:\Users\Admin\AppData\Local\Temp\Official PO....exe"
2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logff.txt
3⤵
PID:976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 2084
3⤵
- Loads dropped DLL
PID:740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\logmail.txt
3⤵
- Accesses Microsoft Outlook accounts
PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Official PO....exe

Filesize
445KB

MD5
9de863a40fb1a7571f2ec1aafbafcf6c

SHA1
f8c1684291601d17fc2e71e839ffe2fa9f388503

SHA256
91f5986fa6f0e8d7c697f634f493726b5364ba645682ff7208dd326681036656

SHA512
798f007c15bf28a4d848b7a09b8aa079c22666ec27f57663f263b0aff9f7958592bd34be5e36048c3ed7e4fc40e4d4731525f35b4b9712c4fbd47a87c514e3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Official PO....exe

Filesize
445KB

MD5
9de863a40fb1a7571f2ec1aafbafcf6c

SHA1
f8c1684291601d17fc2e71e839ffe2fa9f388503

SHA256
91f5986fa6f0e8d7c697f634f493726b5364ba645682ff7208dd326681036656

SHA512
798f007c15bf28a4d848b7a09b8aa079c22666ec27f57663f263b0aff9f7958592bd34be5e36048c3ed7e4fc40e4d4731525f35b4b9712c4fbd47a87c514e3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\logff.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\Official PO....exe

Filesize
445KB

MD5
9de863a40fb1a7571f2ec1aafbafcf6c

SHA1
f8c1684291601d17fc2e71e839ffe2fa9f388503

SHA256
91f5986fa6f0e8d7c697f634f493726b5364ba645682ff7208dd326681036656

SHA512
798f007c15bf28a4d848b7a09b8aa079c22666ec27f57663f263b0aff9f7958592bd34be5e36048c3ed7e4fc40e4d4731525f35b4b9712c4fbd47a87c514e3b7

Download Submit
\Users\Admin\AppData\Local\Temp\Official PO....exe

Filesize
445KB

MD5
9de863a40fb1a7571f2ec1aafbafcf6c

SHA1
f8c1684291601d17fc2e71e839ffe2fa9f388503

SHA256
91f5986fa6f0e8d7c697f634f493726b5364ba645682ff7208dd326681036656

SHA512
798f007c15bf28a4d848b7a09b8aa079c22666ec27f57663f263b0aff9f7958592bd34be5e36048c3ed7e4fc40e4d4731525f35b4b9712c4fbd47a87c514e3b7

Download Submit
\Users\Admin\AppData\Local\Temp\Official PO....exe

Filesize
445KB

MD5
9de863a40fb1a7571f2ec1aafbafcf6c

SHA1
f8c1684291601d17fc2e71e839ffe2fa9f388503

SHA256
91f5986fa6f0e8d7c697f634f493726b5364ba645682ff7208dd326681036656

SHA512
798f007c15bf28a4d848b7a09b8aa079c22666ec27f57663f263b0aff9f7958592bd34be5e36048c3ed7e4fc40e4d4731525f35b4b9712c4fbd47a87c514e3b7

Download Submit
memory/740-79-0x0000000000000000-mapping.dmp

Download
memory/976-78-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-74-0x000000000040E758-mapping.dmp

Download
memory/976-77-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-65-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-66-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-68-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-70-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-71-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/976-73-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1144-63-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1144-64-0x0000000000CB6000-0x0000000000CC7000-memory.dmp

Filesize
68KB

Download
memory/1144-58-0x0000000000000000-mapping.dmp

Download
memory/1144-99-0x0000000000CB6000-0x0000000000CC7000-memory.dmp

Filesize
68KB

Download
memory/1144-96-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-62-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-55-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1512-88-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-86-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-89-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-92-0x0000000000411654-mapping.dmp

Download
memory/1512-91-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-95-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-84-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-97-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-98-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1512-83-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads