Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 08:23
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230915-en
General
-
Target
tmp.exe
-
Size
483KB
-
MD5
45ae441754ecc9aeb5f47f65d9fd08e9
-
SHA1
f1b1a89ce28fa2af60e3cdb45a5db0b5c48408dd
-
SHA256
c9a4acea3bc6e439c8e8435466f4aaa91f233c3278f77c24eaa6b33e69e8f7f1
-
SHA512
bc17fc3a4a8dffde3fa48c3009a19c2fccf852100f5c1061fc60695e61fddd590c77819b239d673f1592d00ab3b3e056b8d95ed550b1e15d958a0b3dff51dcd1
-
SSDEEP
6144:Qu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Gbv:Qu7wNB5iedQ1RmPEVAWONjpcs/ZpSbv
Malware Config
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1288-15-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1288-34-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1288-35-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1288-36-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2448-8-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2448-9-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2448-22-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2448-8-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2448-9-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1288-15-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/2708-16-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2708-14-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2708-17-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2448-22-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1288-34-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1288-35-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1288-36-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exedescription pid process target process PID 2016 set thread context of 2448 2016 tmp.exe tmp.exe PID 2016 set thread context of 1288 2016 tmp.exe tmp.exe PID 2016 set thread context of 2708 2016 tmp.exe tmp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmp.exepid process 2448 tmp.exe 2448 tmp.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
tmp.exepid process 2016 tmp.exe 2016 tmp.exe 2016 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 2708 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 2016 tmp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
tmp.exedescription pid process target process PID 2016 wrote to memory of 2448 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2448 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2448 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2448 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 1288 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 1288 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 1288 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 1288 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2708 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2708 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2708 2016 tmp.exe tmp.exe PID 2016 wrote to memory of 2708 2016 tmp.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\yceiyorcineebowxvaoawnssvbpjxlqdw"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\awjbz"2⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\lywlaznxk"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yceiyorcineebowxvaoawnssvbpjxlqdwFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/1288-11-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1288-3-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1288-34-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1288-35-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1288-36-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1288-15-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2016-38-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2016-33-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2016-27-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2016-30-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2016-32-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2016-31-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2448-1-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2448-9-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2448-8-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2448-6-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2448-22-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2448-4-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2708-7-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-17-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-14-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-16-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-12-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB