63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe
Size

358KB
MD5

7688549dad99807aadaad6a68a536e23
SHA1

0f2aa7e3e15f3c8929d643312163db9f590cd499
SHA256

63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4
SHA512

5e93c1e43111fcb94adad56befbf4056ccd3b524dc0739a9a18b1c526e0d2823a4b378b917cd0dd07ef5cd35052bdb41b1b51bfdc28b6f3ce25b6fef4d1ad983
SSDEEP

6144:h1pkBq76aOP1esHTKai67o9gftTwHRAzITo7qPbLnf3RutqnyeCRuz5Lkgte5OTc:hr76aUe0txE+xwOtqvnf3RPnyhRuzVXQ

Score

9^/10

collection spyware stealer upx

Malware Config

Signatures

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4864-137-0x0000000000400000-0x000000000041E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4144-141-0x0000000000400000-0x000000000045D000-memory.dmp	WebBrowserPassView
behavioral2/memory/4144-142-0x0000000000400000-0x000000000045D000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4864-137-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral2/memory/4144-141-0x0000000000400000-0x000000000045D000-memory.dmp	Nirsoft
behavioral2/memory/4144-142-0x0000000000400000-0x000000000045D000-memory.dmp	Nirsoft
behavioral2/memory/1152-147-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral2/memory/544-152-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft

Executes dropped EXE 4 IoCs

Processes:

mpv.exeWBP.exemespv.exepv.exe

pid process

4864 mpv.exe
4144 WBP.exe
1152 mespv.exe
544 pv.exe

pid	process
4864	mpv.exe
4144	WBP.exe
1152	mespv.exe
544	pv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mespv.exe	upx
C:\Users\Admin\AppData\Local\Temp\mespv.exe	upx
behavioral2/memory/1152-147-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mpv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mpv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WBP.exemespv.exe

pid process

4144 WBP.exe
4144 WBP.exe
1152 mespv.exe
1152 mespv.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mespv.exe

description pid process

Token: SeDebugPrivilege 1152 mespv.exe

pid	process
4144	WBP.exe
4144	WBP.exe
1152	mespv.exe
1152	mespv.exe

description	pid	process
Token: SeDebugPrivilege	1152	mespv.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe

description	pid	process	target process
PID 3436 wrote to memory of 4864	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	mpv.exe
PID 3436 wrote to memory of 4864	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	mpv.exe
PID 3436 wrote to memory of 4864	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	mpv.exe
PID 3436 wrote to memory of 4144	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	WBP.exe
PID 3436 wrote to memory of 4144	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	WBP.exe
PID 3436 wrote to memory of 4144	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	WBP.exe
PID 3436 wrote to memory of 1152	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	mespv.exe
PID 3436 wrote to memory of 1152	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	mespv.exe
PID 3436 wrote to memory of 1152	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	mespv.exe
PID 3436 wrote to memory of 544	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	pv.exe
PID 3436 wrote to memory of 544	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	pv.exe
PID 3436 wrote to memory of 544	3436	63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe	pv.exe

C:\Users\Admin\AppData\Local\Temp\63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe
"C:\Users\Admin\AppData\Local\Temp\63ebddabe6655046f8d2ec3f7c23e9d9878b8d06f1dfe0f3f72400da3a8058c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3436

C:\Users\Admin\AppData\Local\Temp\mpv.exe
C:\Users\Admin\AppData\Local\Temp\mpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mpvp.txt
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:4864

C:\Users\Admin\AppData\Local\Temp\WBP.exe
C:\Users\Admin\AppData\Local\Temp\WBP.exe /stext C:\Users\Admin\AppData\Local\Temp\WBVP.txt
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4144

C:\Users\Admin\AppData\Local\Temp\mespv.exe
C:\Users\Admin\AppData\Local\Temp\mespv.exe /stext C:\Users\Admin\AppData\Local\Temp\mespvp.txt
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Users\Admin\AppData\Local\Temp\pv.exe
C:\Users\Admin\AppData\Local\Temp\pv.exe /stext C:\Users\Admin\AppData\Local\Temp\pvp.txt
2⤵
- Executes dropped EXE
PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WBP.exe
Filesize
183KB

MD5
6d95f03eaf83b31686f263260202ee36

SHA1
6633ac9d7790031b49bb2a4170ec77591d94bb58

SHA256
29f2a54c829c37fc904a2b682c50b57d6d35e9af5dc7f43d72b68c8c51255103

SHA512
a8dda5f3c9e493f9f0e17bfee40a73f74ac6c4276b22589ec9bb163a91f941d966e4ce3b0866be7488fddd229156d73017fb8b22fc3b90903591fef2045c2b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\WBP.exe
Filesize
183KB

MD5
6d95f03eaf83b31686f263260202ee36

SHA1
6633ac9d7790031b49bb2a4170ec77591d94bb58

SHA256
29f2a54c829c37fc904a2b682c50b57d6d35e9af5dc7f43d72b68c8c51255103

SHA512
a8dda5f3c9e493f9f0e17bfee40a73f74ac6c4276b22589ec9bb163a91f941d966e4ce3b0866be7488fddd229156d73017fb8b22fc3b90903591fef2045c2b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\WBVP.txt
Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Local\Temp\mespv.exe
Filesize
65KB

MD5
ffc52f2b4435fcddaca6e15489a88b75

SHA1
63ec31a04cf176852344d544ae855da0dac64980

SHA256
3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

SHA512
389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mespv.exe
Filesize
65KB

MD5
ffc52f2b4435fcddaca6e15489a88b75

SHA1
63ec31a04cf176852344d544ae855da0dac64980

SHA256
3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

SHA512
389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpv.exe
Filesize
50KB

MD5
a138fca70622323e45d6018125322051

SHA1
b91f8e20569fecabed22e48da5ec626758563488

SHA256
677d333648aba8e2538cbbb9fdd8a32901c67a5e10c8f951970313499304783a

SHA512
b89f1d513608f5b0f8022a8d983cdfec0064ecd5e8479125b40477738fc0f5e2b1aa77868333fd783cd5cd2233e0f018d16d8865650071b1a371d375c22a54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpv.exe
Filesize
50KB

MD5
a138fca70622323e45d6018125322051

SHA1
b91f8e20569fecabed22e48da5ec626758563488

SHA256
677d333648aba8e2538cbbb9fdd8a32901c67a5e10c8f951970313499304783a

SHA512
b89f1d513608f5b0f8022a8d983cdfec0064ecd5e8479125b40477738fc0f5e2b1aa77868333fd783cd5cd2233e0f018d16d8865650071b1a371d375c22a54ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv.exe
Filesize
38KB

MD5
afe3aeeffaa1e1772a926ca45923f33f

SHA1
f20104fa1f75f341818751b5164b5c2b24d2dd9e

SHA256
6cbc1d59fdba6445b8e7243a08bd64816f01fcf6ce7f68570d9170e13c8810a7

SHA512
083732db58970d192b98c4298444b8eba2ecae5fa982b3d9505cfa17bce920106281f66df507e6e211d969a6c553d212e50dcdcfeab4b900301d01c442a0de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv.exe
Filesize
38KB

MD5
afe3aeeffaa1e1772a926ca45923f33f

SHA1
f20104fa1f75f341818751b5164b5c2b24d2dd9e

SHA256
6cbc1d59fdba6445b8e7243a08bd64816f01fcf6ce7f68570d9170e13c8810a7

SHA512
083732db58970d192b98c4298444b8eba2ecae5fa982b3d9505cfa17bce920106281f66df507e6e211d969a6c553d212e50dcdcfeab4b900301d01c442a0de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\pvp.txt
Filesize
725B

MD5
6b46012666cbc58c36ebc6890780d030

SHA1
8b38f95a12de6539cb5f6f2e87910fe3660ca775

SHA256
e4686444d995b94591338562b49e3c1c6e6f2cfed33fdf93ef9957159c2918df

SHA512
d76421df550a0ac3e825510b32c8cfb2ac5e1dc3d4c27507f377d850c8f40e8018b798f7fba2bb05c0f1b8eca45d6a151ec920d5357362768e22bb028f18e822

Download Submit
memory/544-148-0x0000000000000000-mapping.dmp

Download
memory/544-152-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-147-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1152-144-0x0000000000000000-mapping.dmp

Download
memory/3436-132-0x00007FFB84BE0000-0x00007FFB85616000-memory.dmp

Filesize
10.2MB

Download
memory/4144-142-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4144-141-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4144-138-0x0000000000000000-mapping.dmp

Download
memory/4864-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4864-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4864-133-0x0000000000000000-mapping.dmp

Download