Analysis
-
max time kernel
88s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 14:28
Static task
static1
Behavioral task
behavioral1
Sample
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe
Resource
win10v2004-20221111-en
General
-
Target
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe
-
Size
600KB
-
MD5
f0eba722ddeaa6c8c90f9a6f8f1aaedd
-
SHA1
61243c8fd4f6c7d7a1c18af45229446c066ba2c1
-
SHA256
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976
-
SHA512
ed5aa8b0f37c2fd2bd18cf54be78a69f9a4eccefa2f893ab656a775fbef4ede6c2f19e625510ec0fec9191c211c7e116297125525c9d29e6651281b8b0d59c99
-
SSDEEP
12288:xqSPym/Umw6RfKs04nyxflmHmz9Ni5iP6aEsZ3l6oru4eoUwHSmNV:8m/XZ0+y1lmHmZNb6Mru4Eu
Malware Config
Signatures
-
NirSoft MailPassView 11 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1448-61-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/1448-64-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/1448-66-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/1448-68-0x0000000000485A9E-mapping.dmp MailPassView behavioral1/memory/1448-71-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/1448-73-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/956-77-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/956-76-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/956-80-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/956-81-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/956-83-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 11 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1448-61-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/1448-64-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/1448-66-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/1448-68-0x0000000000485A9E-mapping.dmp WebBrowserPassView behavioral1/memory/1448-71-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/1448-73-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/1384-85-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1384-84-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1384-88-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1384-89-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1384-91-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 16 IoCs
Processes:
resource yara_rule behavioral1/memory/1448-61-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/1448-64-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/1448-66-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/1448-68-0x0000000000485A9E-mapping.dmp Nirsoft behavioral1/memory/1448-71-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/1448-73-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/956-77-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/956-76-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/956-80-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/956-81-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/956-83-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1384-85-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1384-84-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1384-88-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1384-89-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1384-91-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 whatismyipaddress.com 7 whatismyipaddress.com 4 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.execda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exedescription pid process target process PID 1912 set thread context of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1448 set thread context of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 set thread context of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exepid process 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exedescription pid process Token: SeDebugPrivilege 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exepid process 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.execda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exedescription pid process target process PID 1912 wrote to memory of 1672 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe schtasks.exe PID 1912 wrote to memory of 1672 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe schtasks.exe PID 1912 wrote to memory of 1672 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe schtasks.exe PID 1912 wrote to memory of 1672 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe schtasks.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1912 wrote to memory of 1448 1912 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 956 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe PID 1448 wrote to memory of 1384 1448 cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe"C:\Users\Admin\AppData\Local\Temp\cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\Windows" /XML "C:\Users\Admin\AppData\Local\Temp\1711874231.xml"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe"C:\Users\Admin\AppData\Local\Temp\cda33b46660f1642dcfb418bbc456fd4ddc0bf8fd9282db6a1ec70740c4a1976.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1711874231.xmlFilesize
1KB
MD5071a8374c675485b84793dfccdd57809
SHA1aca1c659ee7c903ba4e3a355f4d583ca01055484
SHA256f8623be4e670a5e38ceb050f5e06bc7edda58ad29f908cafd8e6b28f967ecf30
SHA51229b58c94d1108a3d18c929e44db08bc399ce211cd04c7022c272259274921d6b7f1a5f17e070b7f1d762b719da27af8059c9fbaa9902ef8f1838b9df6de193c7
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/956-77-0x0000000000411654-mapping.dmp
-
memory/956-83-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/956-81-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/956-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/956-76-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1384-91-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1384-89-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1384-88-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1384-84-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1384-85-0x0000000000442628-mapping.dmp
-
memory/1448-73-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1448-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1448-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1448-71-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1448-75-0x0000000074490000-0x0000000074A3B000-memory.dmpFilesize
5.7MB
-
memory/1448-68-0x0000000000485A9E-mapping.dmp
-
memory/1448-82-0x0000000074490000-0x0000000074A3B000-memory.dmpFilesize
5.7MB
-
memory/1448-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1448-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1448-61-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-55-0x0000000000000000-mapping.dmp
-
memory/1912-70-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB
-
memory/1912-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1912-57-0x0000000074500000-0x0000000074AAB000-memory.dmpFilesize
5.7MB