c9a4acea3bc6e439c8e8435466f4aaa91f233c3278f77c24eaa6b33e69e8f7f1

General

Target

tmp.exe
Size

483KB
MD5

45ae441754ecc9aeb5f47f65d9fd08e9
SHA1

f1b1a89ce28fa2af60e3cdb45a5db0b5c48408dd
SHA256

c9a4acea3bc6e439c8e8435466f4aaa91f233c3278f77c24eaa6b33e69e8f7f1
SHA512

bc17fc3a4a8dffde3fa48c3009a19c2fccf852100f5c1061fc60695e61fddd590c77819b239d673f1592d00ab3b3e056b8d95ed550b1e15d958a0b3dff51dcd1
SSDEEP

6144:Qu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Gbv:Qu7wNB5iedQ1RmPEVAWONjpcs/ZpSbv

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/5056-10-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/5056-17-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4652-6-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4652-23-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4652-6-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/5056-10-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/5056-17-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4976-18-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4976-21-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4652-23-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

tmp.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	tmp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 3776 set thread context of 4652	3776	tmp.exe	tmp.exe
PID 3776 set thread context of 5056	3776	tmp.exe	tmp.exe
PID 3776 set thread context of 4976	3776	tmp.exe	tmp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

tmp.exetmp.exe

pid process

4652 tmp.exe
4652 tmp.exe
4976 tmp.exe
4976 tmp.exe
4652 tmp.exe
4652 tmp.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

tmp.exe

pid process

3776 tmp.exe
3776 tmp.exe
3776 tmp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 4976 tmp.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tmp.exe

pid process

3776 tmp.exe

pid	process
4652	tmp.exe
4652	tmp.exe
4976	tmp.exe
4976	tmp.exe
4652	tmp.exe
4652	tmp.exe

pid	process
3776	tmp.exe
3776	tmp.exe
3776	tmp.exe

description	pid	process
Token: SeDebugPrivilege	4976	tmp.exe

pid	process
3776	tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 3776 wrote to memory of 4652	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 4652	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 4652	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 5056	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 5056	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 5056	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 4976	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 4976	3776	tmp.exe	tmp.exe
PID 3776 wrote to memory of 4976	3776	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\tpawgp"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\vjfogicbv"
2⤵
- Accesses Microsoft Outlook accounts
PID:5056

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\glkhhavdjxrk"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tpawgp
Filesize
4KB

MD5
54256016ad499fd79eec3ef68594cace

SHA1
070a70ae09608ff5df35f26736a583476b35c59a

SHA256
085e41325891f7cea84e942500532a18057ff766dd54ef67ff6b08f133e5d54a

SHA512
8507d35255335ce453e679cc2da2481d246b41be2fdcca718e403db6c2676394dcc848cdde07e5fff0396dd5de5e4444dbd57394a99cc1e337f23fac34ded269

Download Submit
memory/3776-35-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3776-32-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3776-29-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3776-31-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3776-30-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3776-26-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4652-23-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4652-3-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4652-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4652-6-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4652-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4976-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4976-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4976-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4976-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5056-17-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5056-10-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5056-7-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5056-2-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads