adwind | 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f

Analysis

max time kernel
147s
max time network
57s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
Size

823KB
MD5

65510e95f239192ac363a192203c1d2c
SHA1

1f35acbc9389e21cfd77cc74f4b633d77b0c732d
SHA256

2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f
SHA512

9c801085ad441790e8cb761fac082ba69fcb7fb47ee67773029072fd37c20c24214dc8a824a346d181cf0dec486dc4fc61162a0373e17e4ca90c5670f1316558
SSDEEP

12288:d0ueVG7/ksXLRittWVAChSaglFAk+JFuLRGzD8PjDLAvJ9e9g0EjslPYHD+e8Rx+:3eE4skttWVAJayHLoDC/ABFaNYj1

Score

10^/10

adwind m00nd3v_logger infostealer spyware stealer trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 7 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/files/0x000c00000001230b-56.dat	m00nd3v_logger
behavioral1/files/0x000c00000001230b-59.dat	m00nd3v_logger
behavioral1/files/0x000c00000001230b-65.dat	m00nd3v_logger
behavioral1/files/0x000c00000001230b-63.dat	m00nd3v_logger
behavioral1/files/0x000c00000001230b-60.dat	m00nd3v_logger
behavioral1/files/0x000c00000001230b-67.dat	m00nd3v_logger
behavioral1/files/0x000c00000001230b-69.dat	m00nd3v_logger

NirSoft MailPassView 7 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/files/0x000c00000001230b-56.dat	MailPassView
behavioral1/files/0x000c00000001230b-59.dat	MailPassView
behavioral1/files/0x000c00000001230b-65.dat	MailPassView
behavioral1/files/0x000c00000001230b-63.dat	MailPassView
behavioral1/files/0x000c00000001230b-60.dat	MailPassView
behavioral1/files/0x000c00000001230b-67.dat	MailPassView
behavioral1/files/0x000c00000001230b-69.dat	MailPassView

NirSoft WebBrowserPassView 7 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/files/0x000c00000001230b-56.dat	WebBrowserPassView
behavioral1/files/0x000c00000001230b-59.dat	WebBrowserPassView
behavioral1/files/0x000c00000001230b-65.dat	WebBrowserPassView
behavioral1/files/0x000c00000001230b-63.dat	WebBrowserPassView
behavioral1/files/0x000c00000001230b-60.dat	WebBrowserPassView
behavioral1/files/0x000c00000001230b-67.dat	WebBrowserPassView
behavioral1/files/0x000c00000001230b-69.dat	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001230b-56.dat	Nirsoft
behavioral1/files/0x000c00000001230b-59.dat	Nirsoft
behavioral1/files/0x000c00000001230b-65.dat	Nirsoft
behavioral1/files/0x000c00000001230b-63.dat	Nirsoft
behavioral1/files/0x000c00000001230b-60.dat	Nirsoft
behavioral1/files/0x000c00000001230b-67.dat	Nirsoft
behavioral1/files/0x000c00000001230b-69.dat	Nirsoft

Executes dropped EXE 1 IoCs

pid	Process
1628	0ri.exe

Loads dropped DLL 4 IoCs

pid	Process
1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	bot.whatismyipaddress.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
688	javaw.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1628	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	28
PID 1644 wrote to memory of 1628	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	28
PID 1644 wrote to memory of 1628	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	28
PID 1644 wrote to memory of 1628	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	28
PID 1644 wrote to memory of 688	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	29
PID 1644 wrote to memory of 688	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	29
PID 1644 wrote to memory of 688	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	29
PID 1644 wrote to memory of 688	1644	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	29
PID 688 wrote to memory of 1772	688	javaw.exe	30
PID 688 wrote to memory of 1772	688	javaw.exe	30
PID 688 wrote to memory of 1772	688	javaw.exe	30
PID 688 wrote to memory of 1616	688	javaw.exe	33
PID 688 wrote to memory of 1616	688	javaw.exe	33
PID 688 wrote to memory of 1616	688	javaw.exe	33
PID 1616 wrote to memory of 1444	1616	cmd.exe	35
PID 1616 wrote to memory of 1444	1616	cmd.exe	35
PID 1616 wrote to memory of 1444	1616	cmd.exe	35
PID 688 wrote to memory of 924	688	javaw.exe	36
PID 688 wrote to memory of 924	688	javaw.exe	36
PID 688 wrote to memory of 924	688	javaw.exe	36
PID 924 wrote to memory of 2000	924	cmd.exe	38
PID 924 wrote to memory of 2000	924	cmd.exe	38
PID 924 wrote to memory of 2000	924	cmd.exe	38
PID 688 wrote to memory of 872	688	javaw.exe	39
PID 688 wrote to memory of 872	688	javaw.exe	39
PID 688 wrote to memory of 872	688	javaw.exe	39

C:\Users\Admin\AppData\Local\Temp\2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
"C:\Users\Admin\AppData\Local\Temp\2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\0ri.exe
  "C:\Users\Admin\AppData\Local\Temp\0ri.exe"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\ori.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Program Files\Java\jre7\bin\java.exe
    "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.81187020901877428407303225218213963.class
    3⤵
    PID:1772
- - C:\Windows\system32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive916299395463812108.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive916299395463812108.vbs
      4⤵
      PID:1444
- - C:\Windows\system32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6759086955844206921.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6759086955844206921.vbs
      4⤵
      PID:2000
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
    3⤵
    PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive6759086955844206921.vbs

Filesize
281B

MD5
a32c109297ed1ca155598cd295c26611

SHA1
dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

SHA256
45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

SHA512
70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive916299395463812108.vbs

Filesize
276B

MD5
3bdfd33017806b85949b6faa7d4b98e4

SHA1
f92844fee69ef98db6e68931adfaa9a0a0f8ce66

SHA256
9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

SHA512
ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.81187020901877428407303225218213963.class

Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ori.jar

Filesize
479KB

MD5
6a8979d38cd1d99c33eaa74aa7775143

SHA1
efa1b842a8c66c2800e870f090eaeddca0bacdb6

SHA256
50fb5acf95563164b7c3e5a922641cfefbfec4abb6d31439dc69fba075ca4b56

SHA512
4e529d575800446246c7011c907c5dd7169892680d3a8fc126b22d0996e6a1819e013da41133090bc1f287d4358b059d3d5f1c48f57d02a0a148cdd0e0150acb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3499517378-2376672570-1134980332-1000\83aa4cc77f591dfc2374580bbd95f6ba_e5bb12bd-5c29-4c03-8405-2e8855cd8e1a

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcr100.dll

Filesize
809KB

MD5
df3ca8d16bded6a54977b30e66864d33

SHA1
b7b9349b33230c5b80886f5c1f0a42848661c883

SHA256
1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

SHA512
951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

Download Submit
\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
memory/688-99-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/688-122-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/688-138-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/688-141-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/688-90-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1628-103-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/1628-74-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/1644-70-0x0000000000400000-0x00000000004CF778-memory.dmp

Filesize
829KB

Download
memory/1772-98-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1772-106-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download