Analysis
-
max time kernel
184s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 14:30
Static task
static1
Behavioral task
behavioral1
Sample
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe
Resource
win10v2004-20220812-en
General
-
Target
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe
-
Size
352KB
-
MD5
332ea30ddd5f5945160940049cdd81db
-
SHA1
2621d2623492360f0e18f15809000e9e1fb61425
-
SHA256
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54
-
SHA512
dfa0deb49065f532c4acce68c75e4c3e205a3d27a25ace7a133e47ef11a35899b76f7d9b83c46e7285fadcf0a25eb1fd5875cd9471eaa6b1f6faead01decae34
-
SSDEEP
6144:k/AyZ6AZgyOCIheMocOyh4XV8JnkiYyZXlva5XnF1s9pS/BJUz/ugM8e6/j:k/Atj/Oz5+BUJFCXS/vUz/vM8e
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1400-135-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1400-144-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1400-152-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1900-176-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1400-178-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1900-192-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/220-163-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/220-164-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/220-177-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/3872-190-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/3872-191-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 5 IoCs
Processes:
resource yara_rule behavioral2/memory/220-163-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/220-164-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/220-177-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/3872-190-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/3872-191-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
AeLookupSvi.exeProfSvc.exeAeLookupSvi.exepid process 1632 AeLookupSvi.exe 4724 ProfSvc.exe 772 AeLookupSvi.exe -
Processes:
resource yara_rule behavioral2/memory/2044-140-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2044-142-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2044-143-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2044-145-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2044-146-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/220-160-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/220-162-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/220-163-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/220-164-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4740-173-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4740-174-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4740-175-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/220-177-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3872-189-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3872-190-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3872-191-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ProfSvc.exefe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exeAeLookupSvi.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ProfSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation AeLookupSvi.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
Processes:
vbc.exevbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AeLookupSvi.exeAeLookupSvi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe" AeLookupSvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe" AeLookupSvi.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exevbc.exeProfSvc.exevbc.exedescription pid process target process PID 4332 set thread context of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 1400 set thread context of 2044 1400 vbc.exe vbc.exe PID 1400 set thread context of 220 1400 vbc.exe vbc.exe PID 4724 set thread context of 1900 4724 ProfSvc.exe vbc.exe PID 1900 set thread context of 4740 1900 vbc.exe vbc.exe PID 1900 set thread context of 3872 1900 vbc.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exepid process 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exeAeLookupSvi.exeProfSvc.exeAeLookupSvi.exedescription pid process Token: SeDebugPrivilege 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe Token: SeDebugPrivilege 1632 AeLookupSvi.exe Token: SeDebugPrivilege 4724 ProfSvc.exe Token: SeDebugPrivilege 772 AeLookupSvi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exevbc.exepid process 1400 vbc.exe 1900 vbc.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exevbc.exeAeLookupSvi.exeProfSvc.exevbc.exedescription pid process target process PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 4332 wrote to memory of 1400 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 2044 1400 vbc.exe vbc.exe PID 4332 wrote to memory of 1632 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe AeLookupSvi.exe PID 4332 wrote to memory of 1632 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe AeLookupSvi.exe PID 4332 wrote to memory of 1632 4332 fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe AeLookupSvi.exe PID 1632 wrote to memory of 4724 1632 AeLookupSvi.exe ProfSvc.exe PID 1632 wrote to memory of 4724 1632 AeLookupSvi.exe ProfSvc.exe PID 1632 wrote to memory of 4724 1632 AeLookupSvi.exe ProfSvc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 220 1400 vbc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 4724 wrote to memory of 1900 4724 ProfSvc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 4740 1900 vbc.exe vbc.exe PID 4724 wrote to memory of 772 4724 ProfSvc.exe AeLookupSvi.exe PID 4724 wrote to memory of 772 4724 ProfSvc.exe AeLookupSvi.exe PID 4724 wrote to memory of 772 4724 ProfSvc.exe AeLookupSvi.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe PID 1900 wrote to memory of 3872 1900 vbc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe"C:\Users\Admin\AppData\Local\Temp\fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\B4egtCcmlK.ini"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\YmXv0SfMbL.ini"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\FKXxGWLXg0.ini"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\RyXF7wmJld.ini"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AeLookupSvi.exe.logFilesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
C:\Users\Admin\AppData\Local\Temp\B4egtCcmlK.iniFilesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
C:\Users\Admin\AppData\Local\Temp\FKXxGWLXg0.iniFilesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exeFilesize
7KB
MD57846c5ff178c4d9f5b4301735fc1107d
SHA17a1d7fa6a1bc41cf95c43db2a5268cea38672914
SHA25673b3c4177769e149564c953c022423ac0227b3f3a3fb649767b3edd2994817e9
SHA5120a82b8c9c47cb17cdc7b58e240245bb5567086995223d4196439b6b6656af85af168b1a5345ba8cc3a68565ca6d0ae242cfe55caa0e3d3cf06cef0162958365c
-
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exeFilesize
7KB
MD57846c5ff178c4d9f5b4301735fc1107d
SHA17a1d7fa6a1bc41cf95c43db2a5268cea38672914
SHA25673b3c4177769e149564c953c022423ac0227b3f3a3fb649767b3edd2994817e9
SHA5120a82b8c9c47cb17cdc7b58e240245bb5567086995223d4196439b6b6656af85af168b1a5345ba8cc3a68565ca6d0ae242cfe55caa0e3d3cf06cef0162958365c
-
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exeFilesize
7KB
MD57846c5ff178c4d9f5b4301735fc1107d
SHA17a1d7fa6a1bc41cf95c43db2a5268cea38672914
SHA25673b3c4177769e149564c953c022423ac0227b3f3a3fb649767b3edd2994817e9
SHA5120a82b8c9c47cb17cdc7b58e240245bb5567086995223d4196439b6b6656af85af168b1a5345ba8cc3a68565ca6d0ae242cfe55caa0e3d3cf06cef0162958365c
-
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exeFilesize
352KB
MD5332ea30ddd5f5945160940049cdd81db
SHA12621d2623492360f0e18f15809000e9e1fb61425
SHA256fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54
SHA512dfa0deb49065f532c4acce68c75e4c3e205a3d27a25ace7a133e47ef11a35899b76f7d9b83c46e7285fadcf0a25eb1fd5875cd9471eaa6b1f6faead01decae34
-
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exeFilesize
352KB
MD5332ea30ddd5f5945160940049cdd81db
SHA12621d2623492360f0e18f15809000e9e1fb61425
SHA256fe477fe96dbdb74a7c725429231e78a414f348b7a22c7b71c5a864dcd9829f54
SHA512dfa0deb49065f532c4acce68c75e4c3e205a3d27a25ace7a133e47ef11a35899b76f7d9b83c46e7285fadcf0a25eb1fd5875cd9471eaa6b1f6faead01decae34
-
memory/220-160-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/220-177-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/220-159-0x0000000000000000-mapping.dmp
-
memory/220-162-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/220-163-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/220-164-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/772-184-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/772-193-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/772-181-0x0000000000000000-mapping.dmp
-
memory/1400-144-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1400-152-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1400-178-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1400-135-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1400-134-0x0000000000000000-mapping.dmp
-
memory/1632-153-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/1632-147-0x0000000000000000-mapping.dmp
-
memory/1632-150-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/1632-180-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/1900-176-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1900-192-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1900-165-0x0000000000000000-mapping.dmp
-
memory/2044-142-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2044-140-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2044-145-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2044-139-0x0000000000000000-mapping.dmp
-
memory/2044-143-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2044-146-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3872-190-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3872-189-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3872-186-0x0000000000000000-mapping.dmp
-
memory/3872-191-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4332-133-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/4332-179-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/4332-132-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/4724-155-0x0000000000000000-mapping.dmp
-
memory/4724-158-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/4724-157-0x00000000748E0000-0x0000000074E91000-memory.dmpFilesize
5.7MB
-
memory/4740-175-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4740-174-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4740-173-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4740-170-0x0000000000000000-mapping.dmp