97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a

General

Target

97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe
Size

328KB
MD5

35dea2e57deb4db483e956752b5c2d85
SHA1

6642f5f041057a6092c71275ffaa1976a5158700
SHA256

97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a
SHA512

10d761eed6a4debdc1b1dd9c9c1892481d81ddd9216206a1c2d3d8e4b1325d63ca9796e6fd323ef89eb3d1b47997e2fc5839c756b16107c973881c5d9915fa49
SSDEEP

6144:YsuBSE+VDpJYWmlwnx9u6BMf0Cv3g6dg9wx/KjigwBa:TGSE+VF9mOx9ukEv3g6dFx/KjYa

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mailpv.exe	MailPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\iepv.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\mailpv.exe	Nirsoft

Executes dropped EXE 3 IoCs

Processes:

passwordfox.exeiepv.exemailpv.exe

pid process

2040 passwordfox.exe
1712 iepv.exe
772 mailpv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2040	passwordfox.exe
1712	iepv.exe
772	mailpv.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mailpv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mailpv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

iepv.exe

description pid process

Token: SeDebugPrivilege 1712 iepv.exe
Token: SeRestorePrivilege 1712 iepv.exe
Token: SeBackupPrivilege 1712 iepv.exe

description	pid	process
Token: SeDebugPrivilege	1712	iepv.exe
Token: SeRestorePrivilege	1712	iepv.exe
Token: SeBackupPrivilege	1712	iepv.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe

description	pid	process	target process
PID 1224 wrote to memory of 2040	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	passwordfox.exe
PID 1224 wrote to memory of 2040	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	passwordfox.exe
PID 1224 wrote to memory of 2040	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	passwordfox.exe
PID 1224 wrote to memory of 2040	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	passwordfox.exe
PID 1224 wrote to memory of 1712	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	iepv.exe
PID 1224 wrote to memory of 1712	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	iepv.exe
PID 1224 wrote to memory of 1712	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	iepv.exe
PID 1224 wrote to memory of 1712	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	iepv.exe
PID 1224 wrote to memory of 772	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	mailpv.exe
PID 1224 wrote to memory of 772	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	mailpv.exe
PID 1224 wrote to memory of 772	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	mailpv.exe
PID 1224 wrote to memory of 772	1224	97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe	mailpv.exe

C:\Users\Admin\AppData\Local\Temp\97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe
"C:\Users\Admin\AppData\Local\Temp\97173fd1058ba5fb03608696b902f2b1f6760c1997aea3b4d094f26af853d05a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
2⤵
- Executes dropped EXE
PID:2040

C:\Users\Admin\AppData\Local\Temp\iepv.exe
C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\ie.txt
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Users\Admin\AppData\Local\Temp\mailpv.exe
C:\Users\Admin\AppData\Local\Temp\mailpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mail.txt
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:772

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\firefox.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\iepv.exe
Filesize
88KB

MD5
96eaf707a7f5e252e0ef640a9f9a41e9

SHA1
1db028b8e2dad98ab25abfa498ffd0e344b8178c

SHA256
9bf3183768ab8133f686e9d59adf9ac7f157a6442026d00fcd49c177deca6de2

SHA512
12f7a815f141c125a50941bace6256de41eb6459f5dae49def6a5d150b816b48b054efa3ef0370d87b546098edb4f6ad2e1d6ebea835eb233bd98f7d225d13c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mailpv.exe
Filesize
96KB

MD5
3f5aca02abb16dbf86748596e4fa0258

SHA1
1588bfd4e090d3d194879899c02dcc207d5ca257

SHA256
10f703168cc43f60bfd54c69242d3db63d2d60e1114de74956a2439b8a8b3ed0

SHA512
bb96706ec69bee65e94fd5cc5a112e3e50f12d6895444144f7c5190e298960b02a2c922ac249deb2e3fd5f3d23e52b95058cf6262e5599823b576f849fe4b420

Download Submit
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
Filesize
88KB

MD5
09b98d668124d3894814f57e84da1b25

SHA1
13e3ede7c513d7e6853f99309b83ca01a1de41fd

SHA256
432a3ec81735e216dc8a1d637b92158f261b841155960c621c9c149875de4512

SHA512
2f028fe6333a2a7604d919b11172960623f11acccc03626fb85888cf5c5b3e6eb69850baa1e8088ef2d29b4cef9334d2f6496290946e3309f9b1c0b9e1075615

Download Submit
memory/772-63-0x0000000000000000-mapping.dmp

Download
memory/1224-54-0x000007FEF4900000-0x000007FEF5323000-memory.dmp

Filesize
10.1MB

Download
memory/1224-55-0x000007FEF3860000-0x000007FEF48F6000-memory.dmp

Filesize
16.6MB

Download
memory/1712-60-0x0000000000000000-mapping.dmp

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download
memory/2040-58-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads