Analysis
-
max time kernel
177s -
max time network
203s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 18:46
Static task
static1
Behavioral task
behavioral1
Sample
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe
Resource
win7-20221111-en
General
-
Target
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe
-
Size
1.3MB
-
MD5
8977c63e3448ab7a352312ffb92c95e2
-
SHA1
9a9fc7316768553c7b707f8a6a7f39ee92cd7d3c
-
SHA256
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff
-
SHA512
bc0755ac0ac14f7189bf35e1fbe7c23391a1635639a19701e82183448fe102d1729f4a9e5579e0881847e8f867a50d264f991828c74b45aeace5ac43a88d6b0b
-
SSDEEP
24576:fErl6z8ueTLDAxgOY0vb6irt/Bl1H3L9FQRJg+qyxS9+ZVY/dG6b8oD3Fr46ja9o:lzQLDovT35DV7Hr+Tu+AvVD9Hei
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
okigweman2@mail.ru - Password:
schoolboy
Signatures
-
Processes:
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exedescription pid process target process PID 1128 set thread context of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 564 set thread context of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 set thread context of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exepid process 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exevbc.exevbc.exe06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exedescription pid process Token: SeDebugPrivilege 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe Token: SeDebugPrivilege 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe Token: SeDebugPrivilege 1956 vbc.exe Token: SeDebugPrivilege 1144 vbc.exe Token: SeDebugPrivilege 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exedescription pid process target process PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 1128 wrote to memory of 564 1128 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1956 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe PID 564 wrote to memory of 1144 564 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe vbc.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe"C:\Users\Admin\AppData\Local\Temp\06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe"1⤵
- UAC bypass
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe"C:\Users\Admin\AppData\Local\Temp\06703ebe2c90974993cbc409e8e5815e108e1ea8270d374a93b55eed38f6e5ff.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
329B
MD5f8ddf0fe04f214d64c3e5094ed622858
SHA1245a91a1c968c45820fbbb319c1bcfc98b01b04e
SHA256f73d76c930aa76b78390a50ee72b9169c7064b9e1256de76ab9ffb43bca8f5d3
SHA512e6385a3d47f8969f2079ae28a4e2753c2da60e37601ebd15049e21f1490e7a1ec760a3cc6c8b75a8049aa8a08735a9f24187d7ad13c6ac8d4a5510dc88718900
-
memory/564-59-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-68-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-84-0x0000000000B65000-0x0000000000B76000-memory.dmpFilesize
68KB
-
memory/564-61-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-62-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-63-0x000000000051BACE-mapping.dmp
-
memory/564-65-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-57-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-86-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/564-70-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/564-56-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/564-103-0x0000000000B65000-0x0000000000B76000-memory.dmpFilesize
68KB
-
memory/1128-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1128-55-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1128-67-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1144-92-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-97-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-105-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-102-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-101-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-98-0x0000000000460E2D-mapping.dmp
-
memory/1144-96-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-94-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-89-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-90-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1956-74-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-88-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-76-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-80-0x0000000000462B6D-mapping.dmp
-
memory/1956-78-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-85-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-79-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-72-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-71-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1956-83-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB