613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe
Size

359KB
MD5

584957b7e07052ca10d019ebdbd09e1b
SHA1

414c8c39bea78efb4baa333782afecfa720a9e23
SHA256

613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5
SHA512

ee35d11c6289a1d3346c18a58f6e05a9e6d9379372e517b6ad0727c7a28982582afb99b83532345fcc8990ed1f13943e1f962b815a72ba2e57c0fbf127e93d16
SSDEEP

6144:zX/rBa6DToxZwrvQuE8NrJf6spouHOxtGk6jeFDY15u8gA+s7PSmlE390GbXUmEf:TzDTo+c8NlvH0tGJjeM5u8v+VmlE2GLI

Score

9^/10

collection spyware stealer upx

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4540-137-0x0000000000400000-0x000000000041E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3780-141-0x0000000000400000-0x000000000045D000-memory.dmp	WebBrowserPassView
behavioral2/memory/3780-142-0x0000000000400000-0x000000000045D000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4540-137-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/3780-141-0x0000000000400000-0x000000000045D000-memory.dmp	Nirsoft
behavioral2/memory/3780-142-0x0000000000400000-0x000000000045D000-memory.dmp	Nirsoft
behavioral2/memory/2492-147-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral2/memory/4516-152-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft

Executes dropped EXE 4 IoCs

Processes:

mpv.exeWBP.exemespv.exepv.exe

pid process

4540 mpv.exe
3780 WBP.exe
2492 mespv.exe
4516 pv.exe

pid	process
4540	mpv.exe
3780	WBP.exe
2492	mespv.exe
4516	pv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mespv.exe	upx
C:\Users\Admin\AppData\Local\Temp\mespv.exe	upx
behavioral2/memory/2492-147-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mpv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mpv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WBP.exemespv.exe

pid process

3780 WBP.exe
3780 WBP.exe
2492 mespv.exe
2492 mespv.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mespv.exe

description pid process

Token: SeDebugPrivilege 2492 mespv.exe

pid	process
3780	WBP.exe
3780	WBP.exe
2492	mespv.exe
2492	mespv.exe

description	pid	process
Token: SeDebugPrivilege	2492	mespv.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe

description	pid	process	target process
PID 2224 wrote to memory of 4540	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	mpv.exe
PID 2224 wrote to memory of 4540	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	mpv.exe
PID 2224 wrote to memory of 4540	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	mpv.exe
PID 2224 wrote to memory of 3780	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	WBP.exe
PID 2224 wrote to memory of 3780	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	WBP.exe
PID 2224 wrote to memory of 3780	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	WBP.exe
PID 2224 wrote to memory of 2492	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	mespv.exe
PID 2224 wrote to memory of 2492	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	mespv.exe
PID 2224 wrote to memory of 2492	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	mespv.exe
PID 2224 wrote to memory of 4516	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	pv.exe
PID 2224 wrote to memory of 4516	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	pv.exe
PID 2224 wrote to memory of 4516	2224	613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe	pv.exe

C:\Users\Admin\AppData\Local\Temp\613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe
"C:\Users\Admin\AppData\Local\Temp\613e25fecf47d1c542cd688a8b52f4ca47f3899fe1bb5be66d1c6831fd5186c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\mpv.exe
C:\Users\Admin\AppData\Local\Temp\mpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mpvp.txt
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:4540

C:\Users\Admin\AppData\Local\Temp\WBP.exe
C:\Users\Admin\AppData\Local\Temp\WBP.exe /stext C:\Users\Admin\AppData\Local\Temp\WBVP.txt
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3780

C:\Users\Admin\AppData\Local\Temp\mespv.exe
C:\Users\Admin\AppData\Local\Temp\mespv.exe /stext C:\Users\Admin\AppData\Local\Temp\mespvp.txt
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Local\Temp\pv.exe
C:\Users\Admin\AppData\Local\Temp\pv.exe /stext C:\Users\Admin\AppData\Local\Temp\pvp.txt
2⤵
- Executes dropped EXE
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WBP.exe
Filesize
183KB

MD5
6d95f03eaf83b31686f263260202ee36

SHA1
6633ac9d7790031b49bb2a4170ec77591d94bb58

SHA256
29f2a54c829c37fc904a2b682c50b57d6d35e9af5dc7f43d72b68c8c51255103

SHA512
a8dda5f3c9e493f9f0e17bfee40a73f74ac6c4276b22589ec9bb163a91f941d966e4ce3b0866be7488fddd229156d73017fb8b22fc3b90903591fef2045c2b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\WBP.exe
Filesize
183KB

MD5
6d95f03eaf83b31686f263260202ee36

SHA1
6633ac9d7790031b49bb2a4170ec77591d94bb58

SHA256
29f2a54c829c37fc904a2b682c50b57d6d35e9af5dc7f43d72b68c8c51255103

SHA512
a8dda5f3c9e493f9f0e17bfee40a73f74ac6c4276b22589ec9bb163a91f941d966e4ce3b0866be7488fddd229156d73017fb8b22fc3b90903591fef2045c2b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\WBVP.txt
Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Local\Temp\mespv.exe
Filesize
65KB

MD5
ffc52f2b4435fcddaca6e15489a88b75

SHA1
63ec31a04cf176852344d544ae855da0dac64980

SHA256
3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

SHA512
389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mespv.exe
Filesize
65KB

MD5
ffc52f2b4435fcddaca6e15489a88b75

SHA1
63ec31a04cf176852344d544ae855da0dac64980

SHA256
3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

SHA512
389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpv.exe
Filesize
50KB

MD5
a138fca70622323e45d6018125322051

SHA1
b91f8e20569fecabed22e48da5ec626758563488

SHA256
677d333648aba8e2538cbbb9fdd8a32901c67a5e10c8f951970313499304783a

SHA512
b89f1d513608f5b0f8022a8d983cdfec0064ecd5e8479125b40477738fc0f5e2b1aa77868333fd783cd5cd2233e0f018d16d8865650071b1a371d375c22a54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpv.exe
Filesize
50KB

MD5
a138fca70622323e45d6018125322051

SHA1
b91f8e20569fecabed22e48da5ec626758563488

SHA256
677d333648aba8e2538cbbb9fdd8a32901c67a5e10c8f951970313499304783a

SHA512
b89f1d513608f5b0f8022a8d983cdfec0064ecd5e8479125b40477738fc0f5e2b1aa77868333fd783cd5cd2233e0f018d16d8865650071b1a371d375c22a54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv.exe
Filesize
38KB

MD5
afe3aeeffaa1e1772a926ca45923f33f

SHA1
f20104fa1f75f341818751b5164b5c2b24d2dd9e

SHA256
6cbc1d59fdba6445b8e7243a08bd64816f01fcf6ce7f68570d9170e13c8810a7

SHA512
083732db58970d192b98c4298444b8eba2ecae5fa982b3d9505cfa17bce920106281f66df507e6e211d969a6c553d212e50dcdcfeab4b900301d01c442a0de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv.exe
Filesize
38KB

MD5
afe3aeeffaa1e1772a926ca45923f33f

SHA1
f20104fa1f75f341818751b5164b5c2b24d2dd9e

SHA256
6cbc1d59fdba6445b8e7243a08bd64816f01fcf6ce7f68570d9170e13c8810a7

SHA512
083732db58970d192b98c4298444b8eba2ecae5fa982b3d9505cfa17bce920106281f66df507e6e211d969a6c553d212e50dcdcfeab4b900301d01c442a0de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\pvp.txt
Filesize
725B

MD5
38c48f3ad31a3966457fe5eabbfc5177

SHA1
89527a86b50841d8360bd4acc7e148ac8d62912a

SHA256
1a9cd74856a133a889be3ccff3a41d3c43d086776b45c03c94d78fef10915bfe

SHA512
c1da5373621db7b787a5e665bb9e98cb179eca32643089448efed4dde47a99e9fc949e7a81d1cb2c32ad767cfb37375e9c8c2f2234019a536af28e2126c4cac8

Download Submit
memory/2224-132-0x00007FFDDEAE0000-0x00007FFDDF516000-memory.dmp

Filesize
10.2MB

Download
memory/2492-147-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2492-144-0x0000000000000000-mapping.dmp

Download
memory/3780-142-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3780-141-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3780-138-0x0000000000000000-mapping.dmp

Download
memory/4516-148-0x0000000000000000-mapping.dmp

Download
memory/4516-152-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4540-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4540-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4540-133-0x0000000000000000-mapping.dmp

Download