Overview
overview
10Static
static
101b7f039e2b...67.exe
windows7-x64
101b7f039e2b...67.exe
windows10-2004-x64
101bc393e569...5e.exe
windows7-x64
101bc393e569...5e.exe
windows10-2004-x64
101d25e50b1c...af.exe
windows7-x64
101d25e50b1c...af.exe
windows10-2004-x64
101d9b74bfd7...93.exe
windows7-x64
101d9b74bfd7...93.exe
windows10-2004-x64
101e62a268e2...29.exe
windows7-x64
101e62a268e2...29.exe
windows10-2004-x64
101ed6220c49...b1.exe
windows7-x64
101ed6220c49...b1.exe
windows10-2004-x64
101ee2d1e645...0a.exe
windows7-x64
101ee2d1e645...0a.exe
windows10-2004-x64
101f7f6ca2d7...0a.exe
windows7-x64
101f7f6ca2d7...0a.exe
windows10-2004-x64
101f9c6d71f4...5a.exe
windows7-x64
101f9c6d71f4...5a.exe
windows10-2004-x64
1020573eab37...45.exe
windows7-x64
1020573eab37...45.exe
windows10-2004-x64
1020d1c11837...7d.exe
windows7-x64
1020d1c11837...7d.exe
windows10-2004-x64
1020e0fb805b...2e.exe
windows7-x64
1020e0fb805b...2e.exe
windows10-2004-x64
102122f46b77...53.exe
windows7-x64
102122f46b77...53.exe
windows10-2004-x64
1021550d2e10...4f.exe
windows7-x64
1021550d2e10...4f.exe
windows10-2004-x64
10235041460f...03.exe
windows7-x64
1235041460f...03.exe
windows10-2004-x64
102356c0cbe0...de.doc
windows7-x64
102356c0cbe0...de.doc
windows10-2004-x64
10Analysis
-
max time kernel
151s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2023 06:32
Static task
static1
Behavioral task
behavioral1
Sample
1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
1bc393e569289b6d134bec11c9898225745d2348a8a297bf5fcb3c73a64c385e.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
1bc393e569289b6d134bec11c9898225745d2348a8a297bf5fcb3c73a64c385e.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
1d9b74bfd7d922cfd20bc8197eb35c39ac6d4ed60b918b83133feb4ea7973c93.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
1d9b74bfd7d922cfd20bc8197eb35c39ac6d4ed60b918b83133feb4ea7973c93.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
1ed6220c4999b159446756990086fc270642dcba035ed1ea45126e3dd081c0b1.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
1ed6220c4999b159446756990086fc270642dcba035ed1ea45126e3dd081c0b1.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
1f9c6d71f4eba009486692e8734d2ed0ac586ad0310811c8e938985bc0385e5a.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
1f9c6d71f4eba009486692e8734d2ed0ac586ad0310811c8e938985bc0385e5a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
20d1c1183762918f8077963504cb6971ff65352a34197d534a4d40fe68e0c97d.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
20d1c1183762918f8077963504cb6971ff65352a34197d534a4d40fe68e0c97d.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
20e0fb805bd4501e8361c68b8a2ab67fced87ebfd25c9012e42d38aa83a4bd2e.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
20e0fb805bd4501e8361c68b8a2ab67fced87ebfd25c9012e42d38aa83a4bd2e.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
2122f46b7744ea7cabea57095f4cdcbcdcf176232cfae669e7119c5bd607bf53.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
2122f46b7744ea7cabea57095f4cdcbcdcf176232cfae669e7119c5bd607bf53.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Resource
win10v2004-20230703-en
General
-
Target
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
-
Size
610KB
-
MD5
0f2515f54b09c63412fd214557c39d67
-
SHA1
3a22fe57b5d082138cb0dcf70a787332a2970724
-
SHA256
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f
-
SHA512
e7425b3b8b1455d1d3c2985c794601039ff0588438a13a4ada2ecce9c9597d1f33370bac23e06b2d85bee8cd1cf6d36b4451d7a95be51ce24761c21c7e7a90b3
-
SSDEEP
12288:pfJ7x4QBRXFrrbbVgNK/rwEiOsHK2OHGCMlUdLgqqqLqqqquqqqwqqqLqqqqaqqw:FJVLFXbuGrwTOsHSGCnaqqqLqqqquqqI
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral28/memory/4036-136-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral28/memory/1852-151-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral28/memory/1852-153-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral28/memory/1852-155-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral28/memory/1852-157-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral28/memory/4036-136-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral28/memory/4548-159-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral28/memory/4548-161-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral28/memory/4548-162-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral28/memory/4548-169-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 9 IoCs
Processes:
resource yara_rule behavioral28/memory/4036-136-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral28/memory/1852-151-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral28/memory/1852-153-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral28/memory/1852-155-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral28/memory/1852-157-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral28/memory/4548-159-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral28/memory/4548-161-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral28/memory/4548-162-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral28/memory/4548-169-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 whatismyipaddress.com 33 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exeRegAsm.exedescription pid process target process PID 1164 set thread context of 4036 1164 21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe RegAsm.exe PID 4036 set thread context of 1852 4036 RegAsm.exe vbc.exe PID 4036 set thread context of 4548 4036 RegAsm.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegAsm.exepid process 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe 4036 RegAsm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exepid process 1164 21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 4036 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 4036 RegAsm.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exeRegAsm.exedescription pid process target process PID 1164 wrote to memory of 4036 1164 21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe RegAsm.exe PID 1164 wrote to memory of 4036 1164 21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe RegAsm.exe PID 1164 wrote to memory of 4036 1164 21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe RegAsm.exe PID 1164 wrote to memory of 4036 1164 21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe RegAsm.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 1852 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe PID 4036 wrote to memory of 4548 4036 RegAsm.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe"C:\Users\Admin\AppData\Local\Temp\21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/1164-134-0x0000000000250000-0x00000000002F0000-memory.dmpFilesize
640KB
-
memory/1164-135-0x0000000004E30000-0x0000000004E33000-memory.dmpFilesize
12KB
-
memory/1164-138-0x00000000748D0000-0x0000000075080000-memory.dmpFilesize
7.7MB
-
memory/1164-133-0x00000000748D0000-0x0000000075080000-memory.dmpFilesize
7.7MB
-
memory/1852-151-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1852-157-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1852-156-0x0000000000420000-0x00000000004E9000-memory.dmpFilesize
804KB
-
memory/1852-155-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1852-153-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4036-140-0x0000000004D60000-0x0000000004DFC000-memory.dmpFilesize
624KB
-
memory/4036-141-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/4036-146-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4036-149-0x00000000071F0000-0x0000000007256000-memory.dmpFilesize
408KB
-
memory/4036-150-0x00000000748C0000-0x0000000075070000-memory.dmpFilesize
7.7MB
-
memory/4036-144-0x0000000004E70000-0x0000000004E7A000-memory.dmpFilesize
40KB
-
memory/4036-143-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4036-154-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4036-142-0x0000000004EA0000-0x0000000004F32000-memory.dmpFilesize
584KB
-
memory/4036-145-0x0000000005110000-0x0000000005166000-memory.dmpFilesize
344KB
-
memory/4036-139-0x00000000748C0000-0x0000000075070000-memory.dmpFilesize
7.7MB
-
memory/4036-158-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4036-136-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/4548-161-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4548-162-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4548-159-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4548-169-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB