Analysis
-
max time kernel
172s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 21:00
Static task
static1
Behavioral task
behavioral1
Sample
tmpqlvnosza.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmpqlvnosza.exe
Resource
win10v2004-20230220-en
General
-
Target
tmpqlvnosza.exe
-
Size
658KB
-
MD5
5e9a63f5b3d8f53478a2889c0eefd510
-
SHA1
d6d545146b969ac2ea389a1f11ffcda377549da2
-
SHA256
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
-
SHA512
2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
SSDEEP
12288:gXQnnE6+s3WsZ/lkwR939lgKFWRg1xY0VcRuaHuatAUz3huJ7XrjaJ+:gXQnnYsNHXR9NlgobVcUK7UXrj++
Malware Config
Extracted
Protocol: smtp- Host:
mail.tcci.org.sa - Port:
587 - Username:
fahad.s@tcci.org.sa - Password:
Brown3044
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2272-153-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/2552-166-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/2552-168-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/2552-169-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/2272-153-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/4368-170-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4368-172-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4368-173-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4368-180-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/2272-153-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/2552-166-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2552-168-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2552-169-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4368-170-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4368-172-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4368-173-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4368-180-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmpqlvnosza.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation tmpqlvnosza.exe -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 4312 Windows Update.exe 2272 Windows Update.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windows Update.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
tmpqlvnosza.exedescription ioc process File created C:\Windows\assembly\Desktop.ini tmpqlvnosza.exe File opened for modification C:\Windows\assembly\Desktop.ini tmpqlvnosza.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 52 whatismyipaddress.com 54 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
tmpqlvnosza.exeWindows Update.exeWindows Update.exedescription pid process target process PID 1464 set thread context of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 4312 set thread context of 2272 4312 Windows Update.exe Windows Update.exe PID 2272 set thread context of 2552 2272 Windows Update.exe vbc.exe PID 2272 set thread context of 4368 2272 Windows Update.exe vbc.exe -
Drops file in Windows directory 3 IoCs
Processes:
tmpqlvnosza.exedescription ioc process File created C:\Windows\assembly\Desktop.ini tmpqlvnosza.exe File opened for modification C:\Windows\assembly\Desktop.ini tmpqlvnosza.exe File opened for modification C:\Windows\assembly tmpqlvnosza.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tmpqlvnosza.exeWindows Update.exeWindows Update.exepid process 1464 tmpqlvnosza.exe 1464 tmpqlvnosza.exe 1464 tmpqlvnosza.exe 1464 tmpqlvnosza.exe 1464 tmpqlvnosza.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 1464 tmpqlvnosza.exe 1464 tmpqlvnosza.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 4312 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe 2272 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmpqlvnosza.exeWindows Update.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 1464 tmpqlvnosza.exe Token: SeDebugPrivilege 4312 Windows Update.exe Token: SeDebugPrivilege 2272 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Update.exepid process 2272 Windows Update.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
tmpqlvnosza.exetmpqlvnosza.exeWindows Update.exeWindows Update.exedescription pid process target process PID 1464 wrote to memory of 4716 1464 tmpqlvnosza.exe cmd.exe PID 1464 wrote to memory of 4716 1464 tmpqlvnosza.exe cmd.exe PID 1464 wrote to memory of 4716 1464 tmpqlvnosza.exe cmd.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1464 wrote to memory of 1084 1464 tmpqlvnosza.exe tmpqlvnosza.exe PID 1084 wrote to memory of 4312 1084 tmpqlvnosza.exe Windows Update.exe PID 1084 wrote to memory of 4312 1084 tmpqlvnosza.exe Windows Update.exe PID 1084 wrote to memory of 4312 1084 tmpqlvnosza.exe Windows Update.exe PID 4312 wrote to memory of 212 4312 Windows Update.exe cmd.exe PID 4312 wrote to memory of 212 4312 Windows Update.exe cmd.exe PID 4312 wrote to memory of 212 4312 Windows Update.exe cmd.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 4312 wrote to memory of 2272 4312 Windows Update.exe Windows Update.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 2552 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe PID 2272 wrote to memory of 4368 2272 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpqlvnosza.exe"C:\Users\Admin\AppData\Local\Temp\tmpqlvnosza.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpqlvnosza.exe"C:\Users\Admin\AppData\Local\Temp\tmpqlvnosza.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
49B
MD5192f84fd20e23fee0b0c37b618a5a3ad
SHA18aa09422bf68759bf79b374070080760f84ee197
SHA256b5e09479ec3550cdaa5b819cd26f9a0947b09971d01abc2e71bdee8a96e367a8
SHA512518098c115766f1883e1576e80fb855b4be45b45ddcd55cc757da777fef561a818e5fc178f1b82fd86c1f78e9aef9e0c297b467b27a7a8e2681051457ac765d8
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
memory/1084-145-0x0000000000E90000-0x0000000000EA0000-memory.dmpFilesize
64KB
-
memory/1084-138-0x0000000000E90000-0x0000000000EA0000-memory.dmpFilesize
64KB
-
memory/1464-133-0x0000000000C30000-0x0000000000C40000-memory.dmpFilesize
64KB
-
memory/2272-163-0x0000000000BE0000-0x0000000000BF0000-memory.dmpFilesize
64KB
-
memory/2272-153-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2272-155-0x0000000000BE0000-0x0000000000BF0000-memory.dmpFilesize
64KB
-
memory/2272-157-0x0000000000BE0000-0x0000000000BF0000-memory.dmpFilesize
64KB
-
memory/2272-162-0x0000000000BE0000-0x0000000000BF0000-memory.dmpFilesize
64KB
-
memory/2552-169-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2552-166-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2552-168-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4312-160-0x0000000000D60000-0x0000000000D70000-memory.dmpFilesize
64KB
-
memory/4312-150-0x0000000000D60000-0x0000000000D70000-memory.dmpFilesize
64KB
-
memory/4368-170-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4368-172-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4368-173-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4368-179-0x0000000000460000-0x0000000000529000-memory.dmpFilesize
804KB
-
memory/4368-180-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB