4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a

General

Target

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
Size

852KB
MD5

3afd519037aea12086680cc7f10bfcb7
SHA1

f4e93c5acfdc47df39b7308aa7fd0cdb9ad3fc8a
SHA256

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a
SHA512

a881cb8f06460851bdcc2c5dc11f9dcace589a3da0c37e7cc6fc6d922b9c96d325b128f6d88b7bdb93af984eb6238fadebd1bd9332fafe6b1b9a5e832de6c5bc
SSDEEP

24576:fwNpc5utRISiYhtNn87WyHTKSTYwiyFBBPfxr:Kp6YRISiY67WyHeSTAyFBBR

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1584-144-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/1584-147-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/1584-148-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1552-151-0x00000000005A0000-0x00000000005F9000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1584-144-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1584-147-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1584-148-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1552-151-0x00000000005A0000-0x00000000005F9000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

description	pid	process	target process
PID 1716 set thread context of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 set thread context of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 set thread context of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1304 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

description pid process

Token: SeDebugPrivilege 1920 4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

pid	process
1304	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
"C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Update\Google Update" /XML "C:\Users\Admin\AppData\Local\Temp\a66666.xml"
2⤵
- Creates scheduled task(s)
PID:1304

C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
"C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe"
2⤵
PID:1332

C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
"C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
"C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe" /stext C:\ProgramData\Mails.txt
3⤵
- Accesses Microsoft Outlook accounts
PID:1584

C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
"C:\Users\Admin\AppData\Local\Temp\4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe" /stext C:\ProgramData\Browsers.txt
3⤵
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a66666.xml
Filesize
1KB

MD5
4c7749222beee3c54172ebdafa8ad139

SHA1
8adc6caa4064ccbea80affddeb840db767012510

SHA256
7570d08752ee23436bba73ed27bb4dbba9d60e60d3594437ada0f0833da0816a

SHA512
7f4f3276c973cfe3938430fee3e703cc1e701cc1680b29122983b7f39882d5d34fdd000b6b88ab37707afdfc8b48f7848ae0f4a639b6027e42fb7f49594aea5f

Download Submit
memory/1304-134-0x0000000000000000-mapping.dmp

Download
memory/1552-151-0x00000000005A0000-0x00000000005F9000-memory.dmp

Filesize
356KB

Download
memory/1552-149-0x0000000000000000-mapping.dmp

Download
memory/1584-144-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-148-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-147-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-143-0x0000000000000000-mapping.dmp

Download
memory/1716-133-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/1716-132-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/1716-142-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/1920-141-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/1920-146-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/1920-139-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1920-138-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1920-137-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1920-136-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1716 wrote to memory of 1304	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	schtasks.exe
PID 1716 wrote to memory of 1304	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	schtasks.exe
PID 1716 wrote to memory of 1304	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	schtasks.exe
PID 1716 wrote to memory of 1332	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1332	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1332	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1716 wrote to memory of 1920	1716	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1584	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe
PID 1920 wrote to memory of 1552	1920	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe	4c397f896222d83d538f425e7e7e50119648c31ff65b91306a2191b21513bc1a.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads