83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0

Analysis

max time kernel
82s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe
Size

555KB
MD5

64b4332c9f57ae4f9f08923f1e14ff99
SHA1

d4f6bc5c544a3553840b82da301c5a736590ac23
SHA256

83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0
SHA512

22ebef8758d32b46f7dfa2f2e09aa0bad029e8fd8d401dcd97468f7ff368ec9c15935af4c70ad45e5c7b2b51fd13b283fd3ebc206cc6252e23a7a99126b8243d
SSDEEP

12288:QzDTo+c8NlvH0tGJjeM5u8v+VmlE2GLJ0up7bx:wxbP0tkaM5Rwm6200Wx

Score

9^/10

collection spyware stealer upx

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2092-137-0x0000000000400000-0x000000000041E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3624-141-0x0000000000400000-0x000000000045D000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2092-137-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/3624-141-0x0000000000400000-0x000000000045D000-memory.dmp	Nirsoft
behavioral2/memory/3904-146-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral2/memory/2228-151-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft

Executes dropped EXE 4 IoCs

Processes:

mpv.exeWBP.exemespv.exepv.exe

pid process

2092 mpv.exe
3624 WBP.exe
3904 mespv.exe
2228 pv.exe

pid	process
2092	mpv.exe
3624	WBP.exe
3904	mespv.exe
2228	pv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mespv.exe	upx
C:\Users\Admin\AppData\Local\Temp\mespv.exe	upx
behavioral2/memory/3904-146-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mpv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mpv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WBP.exemespv.exe

pid process

3624 WBP.exe
3624 WBP.exe
3904 mespv.exe
3904 mespv.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mespv.exe

description pid process

Token: SeDebugPrivilege 3904 mespv.exe

pid	process
3624	WBP.exe
3624	WBP.exe
3904	mespv.exe
3904	mespv.exe

description	pid	process
Token: SeDebugPrivilege	3904	mespv.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe

description	pid	process	target process
PID 2320 wrote to memory of 2092	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	mpv.exe
PID 2320 wrote to memory of 2092	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	mpv.exe
PID 2320 wrote to memory of 2092	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	mpv.exe
PID 2320 wrote to memory of 3624	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	WBP.exe
PID 2320 wrote to memory of 3624	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	WBP.exe
PID 2320 wrote to memory of 3624	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	WBP.exe
PID 2320 wrote to memory of 3904	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	mespv.exe
PID 2320 wrote to memory of 3904	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	mespv.exe
PID 2320 wrote to memory of 3904	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	mespv.exe
PID 2320 wrote to memory of 2228	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	pv.exe
PID 2320 wrote to memory of 2228	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	pv.exe
PID 2320 wrote to memory of 2228	2320	83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe	pv.exe

C:\Users\Admin\AppData\Local\Temp\83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe
"C:\Users\Admin\AppData\Local\Temp\83d392cb13556b26a56b14252fd78b9c22d7cbae259148af63e17f36969b6fd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\mpv.exe
C:\Users\Admin\AppData\Local\Temp\mpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mpvp.txt
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:2092

C:\Users\Admin\AppData\Local\Temp\WBP.exe
C:\Users\Admin\AppData\Local\Temp\WBP.exe /stext C:\Users\Admin\AppData\Local\Temp\WBVP.txt
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3624

C:\Users\Admin\AppData\Local\Temp\mespv.exe
C:\Users\Admin\AppData\Local\Temp\mespv.exe /stext C:\Users\Admin\AppData\Local\Temp\mespvp.txt
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Users\Admin\AppData\Local\Temp\pv.exe
C:\Users\Admin\AppData\Local\Temp\pv.exe /stext C:\Users\Admin\AppData\Local\Temp\pvp.txt
2⤵
- Executes dropped EXE
PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WBP.exe
Filesize
183KB

MD5
6d95f03eaf83b31686f263260202ee36

SHA1
6633ac9d7790031b49bb2a4170ec77591d94bb58

SHA256
29f2a54c829c37fc904a2b682c50b57d6d35e9af5dc7f43d72b68c8c51255103

SHA512
a8dda5f3c9e493f9f0e17bfee40a73f74ac6c4276b22589ec9bb163a91f941d966e4ce3b0866be7488fddd229156d73017fb8b22fc3b90903591fef2045c2b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\WBP.exe
Filesize
183KB

MD5
6d95f03eaf83b31686f263260202ee36

SHA1
6633ac9d7790031b49bb2a4170ec77591d94bb58

SHA256
29f2a54c829c37fc904a2b682c50b57d6d35e9af5dc7f43d72b68c8c51255103

SHA512
a8dda5f3c9e493f9f0e17bfee40a73f74ac6c4276b22589ec9bb163a91f941d966e4ce3b0866be7488fddd229156d73017fb8b22fc3b90903591fef2045c2b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\WBVP.txt
Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Local\Temp\mespv.exe
Filesize
65KB

MD5
ffc52f2b4435fcddaca6e15489a88b75

SHA1
63ec31a04cf176852344d544ae855da0dac64980

SHA256
3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

SHA512
389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mespv.exe
Filesize
65KB

MD5
ffc52f2b4435fcddaca6e15489a88b75

SHA1
63ec31a04cf176852344d544ae855da0dac64980

SHA256
3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

SHA512
389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpv.exe
Filesize
50KB

MD5
a138fca70622323e45d6018125322051

SHA1
b91f8e20569fecabed22e48da5ec626758563488

SHA256
677d333648aba8e2538cbbb9fdd8a32901c67a5e10c8f951970313499304783a

SHA512
b89f1d513608f5b0f8022a8d983cdfec0064ecd5e8479125b40477738fc0f5e2b1aa77868333fd783cd5cd2233e0f018d16d8865650071b1a371d375c22a54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpv.exe
Filesize
50KB

MD5
a138fca70622323e45d6018125322051

SHA1
b91f8e20569fecabed22e48da5ec626758563488

SHA256
677d333648aba8e2538cbbb9fdd8a32901c67a5e10c8f951970313499304783a

SHA512
b89f1d513608f5b0f8022a8d983cdfec0064ecd5e8479125b40477738fc0f5e2b1aa77868333fd783cd5cd2233e0f018d16d8865650071b1a371d375c22a54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv.exe
Filesize
38KB

MD5
afe3aeeffaa1e1772a926ca45923f33f

SHA1
f20104fa1f75f341818751b5164b5c2b24d2dd9e

SHA256
6cbc1d59fdba6445b8e7243a08bd64816f01fcf6ce7f68570d9170e13c8810a7

SHA512
083732db58970d192b98c4298444b8eba2ecae5fa982b3d9505cfa17bce920106281f66df507e6e211d969a6c553d212e50dcdcfeab4b900301d01c442a0de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv.exe
Filesize
38KB

MD5
afe3aeeffaa1e1772a926ca45923f33f

SHA1
f20104fa1f75f341818751b5164b5c2b24d2dd9e

SHA256
6cbc1d59fdba6445b8e7243a08bd64816f01fcf6ce7f68570d9170e13c8810a7

SHA512
083732db58970d192b98c4298444b8eba2ecae5fa982b3d9505cfa17bce920106281f66df507e6e211d969a6c553d212e50dcdcfeab4b900301d01c442a0de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\pvp.txt
Filesize
725B

MD5
8cd372c7ee1137e0917839fcea5064e7

SHA1
d3d725c8c09ddca3ea13112851d29bcc25d2a17b

SHA256
e21d345046c4f29a63882ed4466e0d549425bf6d0757adaa654d7f1d5d4029a4

SHA512
8f231202c24950c5ec25043bd9302fd43dab92c13375950cc8f7549c610a7a6957333e9bea4001bef46234a5b4772fa21f8a428b163aaf6315053d8044cd40b0

Download Submit
memory/2092-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2092-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2092-133-0x0000000000000000-mapping.dmp

Download
memory/2228-147-0x0000000000000000-mapping.dmp

Download
memory/2228-151-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2320-132-0x00007FFBFD5F0000-0x00007FFBFE026000-memory.dmp

Filesize
10.2MB

Download
memory/3624-141-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3624-138-0x0000000000000000-mapping.dmp

Download
memory/3904-143-0x0000000000000000-mapping.dmp

Download
memory/3904-146-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download