Analysis
-
max time kernel
97s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:55
Static task
static1
Behavioral task
behavioral1
Sample
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe
Resource
win10v2004-20220812-en
General
-
Target
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe
-
Size
998KB
-
MD5
177a34ddb5abf1506e41085974c5dfa8
-
SHA1
bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
-
SHA256
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
-
SHA512
479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
SSDEEP
24576:R157SnKT9x6tvsrhITbmK0pySuFOzuEh1MyC7h:RfmnKT9xyv6hi5VF1I1v4h
Malware Config
Signatures
-
NirSoft MailPassView 12 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1268-60-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1268-61-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1268-62-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1268-63-0x00000000004EB18E-mapping.dmp MailPassView behavioral1/memory/1268-65-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1268-67-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1800-84-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1800-85-0x0000000000411714-mapping.dmp MailPassView behavioral1/memory/1800-88-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1800-89-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1800-90-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1604-105-0x00000000004EB18E-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 11 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1268-60-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1268-61-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1268-62-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1268-63-0x00000000004EB18E-mapping.dmp WebBrowserPassView behavioral1/memory/1268-65-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1268-67-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1000-92-0x0000000000442F04-mapping.dmp WebBrowserPassView behavioral1/memory/1000-91-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral1/memory/1000-95-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral1/memory/1000-97-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral1/memory/1604-105-0x00000000004EB18E-mapping.dmp WebBrowserPassView -
Nirsoft 24 IoCs
Processes:
resource yara_rule behavioral1/memory/1268-60-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1268-61-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1268-62-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1268-63-0x00000000004EB18E-mapping.dmp Nirsoft behavioral1/memory/1268-65-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1268-67-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1800-84-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1800-85-0x0000000000411714-mapping.dmp Nirsoft behavioral1/memory/1800-88-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1800-89-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1800-90-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1000-92-0x0000000000442F04-mapping.dmp Nirsoft behavioral1/memory/1000-91-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral1/memory/1000-95-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral1/memory/1000-97-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral1/memory/1604-105-0x00000000004EB18E-mapping.dmp Nirsoft behavioral1/memory/1088-114-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral1/memory/1088-115-0x000000000040BEC0-mapping.dmp Nirsoft behavioral1/memory/1088-118-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral1/memory/1088-120-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral1/memory/1372-122-0x000000000043BC50-mapping.dmp Nirsoft behavioral1/memory/1372-121-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral1/memory/1372-125-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral1/memory/1372-126-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
LookupSvi.exesecdrv.exesecdrv.exepid process 1588 LookupSvi.exe 1744 secdrv.exe 1604 secdrv.exe -
Loads dropped DLL 2 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exeLookupSvi.exepid process 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
LookupSvi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Macrovision Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe" LookupSvi.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 5 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 6 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exesecdrv.exedescription pid process target process PID 1272 set thread context of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1268 set thread context of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 set thread context of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1744 set thread context of 1604 1744 secdrv.exe secdrv.exe PID 1268 set thread context of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 set thread context of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exeLookupSvi.exepid process 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 1588 LookupSvi.exe 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exeLookupSvi.exesecdrv.exedescription pid process Token: SeDebugPrivilege 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe Token: SeDebugPrivilege 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe Token: SeDebugPrivilege 1588 LookupSvi.exe Token: SeDebugPrivilege 1744 secdrv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exepid process 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exeLookupSvi.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exesecdrv.exedescription pid process target process PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1268 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 1272 wrote to memory of 1588 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 1272 wrote to memory of 1588 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 1272 wrote to memory of 1588 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 1272 wrote to memory of 1588 1272 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 1588 wrote to memory of 1744 1588 LookupSvi.exe secdrv.exe PID 1588 wrote to memory of 1744 1588 LookupSvi.exe secdrv.exe PID 1588 wrote to memory of 1744 1588 LookupSvi.exe secdrv.exe PID 1588 wrote to memory of 1744 1588 LookupSvi.exe secdrv.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1800 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1000 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1744 wrote to memory of 1604 1744 secdrv.exe secdrv.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1088 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 1268 wrote to memory of 1372 1268 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderprodkey.txtFilesize
1KB
MD577cb34ce76be9099649a0b1b13a019e3
SHA14ea05e97b5d183c532a2e5c322f7379eb8603980
SHA256fb50d9d26eee22484ea63f95ac3ce6ac329a4f020c2b73bbc8de859080bb3036
SHA5126288a9436867545636f64c3679bb73699c92b42071c17aad0b9365b533aa8bfc891313220fb9727f638a534453345783c5c8af6bc0460976dec9c53da572c886
-
C:\Users\Admin\AppData\Local\Temp\holderskypeview.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
memory/1000-92-0x0000000000442F04-mapping.dmp
-
memory/1000-91-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1000-95-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1000-97-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1088-114-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1088-115-0x000000000040BEC0-mapping.dmp
-
memory/1088-118-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1088-120-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1268-58-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1268-60-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1268-67-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1268-57-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1268-82-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1268-65-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1268-61-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1268-74-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1268-63-0x00000000004EB18E-mapping.dmp
-
memory/1268-62-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1272-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1272-56-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1272-55-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1372-126-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1372-125-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1372-121-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1372-122-0x000000000043BC50-mapping.dmp
-
memory/1588-75-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1588-83-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1588-70-0x0000000000000000-mapping.dmp
-
memory/1604-112-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1604-113-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1604-105-0x00000000004EB18E-mapping.dmp
-
memory/1744-98-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1744-81-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1744-78-0x0000000000000000-mapping.dmp
-
memory/1800-90-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1800-88-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1800-85-0x0000000000411714-mapping.dmp
-
memory/1800-89-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1800-84-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB