Overview
overview
10Static
static
1100.exe
windows7-x64
8100.exe
windows10-2004-x64
10101.exe
windows7-x64
1101.exe
windows10-2004-x64
1102.exe
windows7-x64
8102.exe
windows10-2004-x64
5103.exe
windows7-x64
8103.exe
windows10-2004-x64
1105.exe
windows7-x64
10105.exe
windows10-2004-x64
10106.exe
windows7-x64
8106.exe
windows10-2004-x64
1107.exe
windows7-x64
6107.exe
windows10-2004-x64
6108.exe
windows7-x64
10108.exe
windows10-2004-x64
10109.exe
windows7-x64
10109.exe
windows10-2004-x64
5110.exe
windows7-x64
10110.exe
windows10-2004-x64
10111.exe
windows7-x64
10111.exe
windows10-2004-x64
10112.exe
windows7-x64
8112.exe
windows10-2004-x64
7113.exe
windows7-x64
10113.exe
windows10-2004-x64
10114.exe
windows7-x64
10114.exe
windows10-2004-x64
8115.exe
windows7-x64
10115.exe
windows10-2004-x64
10116.exe
windows7-x64
8116.exe
windows10-2004-x64
7Analysis
-
max time kernel
125s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 11:26
Static task
static1
Behavioral task
behavioral1
Sample
100.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
100.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
101.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
101.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
102.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral6
Sample
102.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
103.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral8
Sample
103.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
105.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral10
Sample
105.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
106.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral12
Sample
106.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
107.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral14
Sample
107.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
108.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral16
Sample
108.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
109.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral18
Sample
109.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
110.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
110.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
111.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral22
Sample
111.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
112.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral24
Sample
112.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
113.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral26
Sample
113.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
114.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral28
Sample
114.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
115.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral30
Sample
115.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
116.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral32
Sample
116.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
109.exe
-
Size
1.5MB
-
MD5
48b5f870cd52e63adff35391961974b5
-
SHA1
b355a7ea90387606c41b9641c9c7857250335ed9
-
SHA256
7a84c0090ef3aa1210ff677298007ab3c6a626b047473f6f4854955cd4e0213f
-
SHA512
a3245fcfc944514a0a28e9e0887eeba7b971fdc2a7c5168e4b3311f38a2bdc2692800fc7e42e64938e7ec91b9f4dcdb57f77d33f5dcc2e36e8590c065e2f698f
-
SSDEEP
24576:w6LGRV7EMd5A5/B81TJvWkw1RaksEloH6KWUIuYYTcrL7VF3JOkK74gYx:w6qRV7EMd5A561TKTPTsW8A34NYx
Malware Config
Signatures
-
NirSoft MailPassView 9 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral17/memory/320-57-0x0000000000400000-0x00000000004AE000-memory.dmp MailPassView behavioral17/memory/320-58-0x000000000048599E-mapping.dmp MailPassView behavioral17/memory/320-60-0x0000000000400000-0x00000000004AE000-memory.dmp MailPassView behavioral17/memory/320-62-0x0000000000400000-0x00000000004AE000-memory.dmp MailPassView behavioral17/memory/768-67-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral17/memory/768-68-0x0000000000411654-mapping.dmp MailPassView behavioral17/memory/768-71-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral17/memory/768-73-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral17/memory/768-79-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral17/memory/320-57-0x0000000000400000-0x00000000004AE000-memory.dmp WebBrowserPassView behavioral17/memory/320-58-0x000000000048599E-mapping.dmp WebBrowserPassView behavioral17/memory/320-60-0x0000000000400000-0x00000000004AE000-memory.dmp WebBrowserPassView behavioral17/memory/320-62-0x0000000000400000-0x00000000004AE000-memory.dmp WebBrowserPassView behavioral17/memory/1864-74-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral17/memory/1864-75-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral17/memory/1864-78-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral17/memory/1864-80-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 13 IoCs
resource yara_rule behavioral17/memory/320-57-0x0000000000400000-0x00000000004AE000-memory.dmp Nirsoft behavioral17/memory/320-58-0x000000000048599E-mapping.dmp Nirsoft behavioral17/memory/320-60-0x0000000000400000-0x00000000004AE000-memory.dmp Nirsoft behavioral17/memory/320-62-0x0000000000400000-0x00000000004AE000-memory.dmp Nirsoft behavioral17/memory/768-67-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral17/memory/768-68-0x0000000000411654-mapping.dmp Nirsoft behavioral17/memory/768-71-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral17/memory/768-73-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral17/memory/1864-74-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral17/memory/1864-75-0x0000000000442628-mapping.dmp Nirsoft behavioral17/memory/1864-78-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral17/memory/768-79-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral17/memory/1864-80-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 832 set thread context of 320 832 109.exe 28 PID 320 set thread context of 768 320 109.exe 30 PID 320 set thread context of 1864 320 109.exe 31 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 320 109.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 832 109.exe Token: SeDebugPrivilege 320 109.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 320 109.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 832 wrote to memory of 320 832 109.exe 28 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 768 320 109.exe 30 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31 PID 320 wrote to memory of 1864 320 109.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\109.exe"C:\Users\Admin\AppData\Local\Temp\109.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\109.exeC:\Users\Admin\AppData\Local\Temp\109.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:768
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵PID:1864
-
-