69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f

Analysis

max time kernel
214s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 17:47

Target

69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
Size

1.0MB
MD5

268fe9fa007f30f415ecc37e9d1f7896
SHA1

40cb1e41c800e1498a84ea747106e366c64448e3
SHA256

69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f
SHA512

f80eb17dcbdd627afe1bbfd9705c895fbeec6a3fc4b8d774ec78c6fdd1356d7e08051b62cd873ce691132d81c1ec3e7ba71b165479d17638a9a4bbefde359009
SSDEEP

24576:db5OPKhUgmM1LxnyIuR/2DTiEMRF5bNN5:95OinxnHd2EMRD5

Score

9^/10

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4652-136-0x0000000000400000-0x00000000004F0000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4652-136-0x0000000000400000-0x00000000004F0000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4652-136-0x0000000000400000-0x00000000004F0000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

79 whatismyipaddress.com

flow	ioc
79	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

description	pid	process	target process
PID 3264 set thread context of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

description pid process

Token: SeDebugPrivilege 3264 69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

description	pid	process
Token: SeDebugPrivilege	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

description	pid	process	target process
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
PID 3264 wrote to memory of 4652	3264	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe	69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe

C:\Users\Admin\AppData\Local\Temp\69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe
"C:\Users\Admin\AppData\Local\Temp\69bf7c8dcaafad0b949ecf7938b3c8397680e52868ecea03e3568c929ddcb53f.exe"
2⤵
PID:4652

memory/3264-133-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/3264-134-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/3264-137-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/4652-135-0x0000000000000000-mapping.dmp

Download
memory/4652-136-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4652-138-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/4652-139-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download