Analysis

  • max time kernel
    155s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 08:23

General

  • Target

    tmp.exe

  • Size

    483KB

  • MD5

    45ae441754ecc9aeb5f47f65d9fd08e9

  • SHA1

    f1b1a89ce28fa2af60e3cdb45a5db0b5c48408dd

  • SHA256

    c9a4acea3bc6e439c8e8435466f4aaa91f233c3278f77c24eaa6b33e69e8f7f1

  • SHA512

    bc17fc3a4a8dffde3fa48c3009a19c2fccf852100f5c1061fc60695e61fddd590c77819b239d673f1592d00ab3b3e056b8d95ed550b1e15d958a0b3dff51dcd1

  • SSDEEP

    6144:Qu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Gbv:Qu7wNB5iedQ1RmPEVAWONjpcs/ZpSbv

Malware Config

Signatures

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\cixfosgizncvda"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4340
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\nkdypkrknvuanoxaj"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:732
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\peqiidbdbdmepvleandmj"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4152
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\jteamkopo"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2812
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\unrsncyrciil"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:1816
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\epwlgurkyyapoqas"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jteamkopo
    Filesize

    4KB

    MD5

    28cfa3f332aaea0dbc2c6b239ae55629

    SHA1

    69508ce857a1b4d2643967fa5438330fc5a919c3

    SHA256

    f53cfdd9e5697f08e83d67f2b7436f116fa6fea044d3a7ac09e9f4257a148e85

    SHA512

    2fdbb194c93111dc5c26df24a7e2d5a0994d05286b4541e09180a2fceb653f86cc6e7a8ed5ad1d1d461a280ab5c015aadbfb4e6c0f98aea6cb78828ffe288e54

  • memory/732-11-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/732-1-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/732-18-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/732-8-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/1816-40-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/2812-51-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/3548-59-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3548-58-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3548-55-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3548-60-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3548-61-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3548-62-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/4152-19-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4152-13-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4152-9-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4152-6-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4152-4-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4184-43-0x0000000000430000-0x00000000004F9000-memory.dmp
    Filesize

    804KB

  • memory/4184-44-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4340-30-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4340-50-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4340-0-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4340-14-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4340-12-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4340-7-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB