c9a4acea3bc6e439c8e8435466f4aaa91f233c3278f77c24eaa6b33e69e8f7f1

General

Target

tmp.exe
Size

483KB
MD5

45ae441754ecc9aeb5f47f65d9fd08e9
SHA1

f1b1a89ce28fa2af60e3cdb45a5db0b5c48408dd
SHA256

c9a4acea3bc6e439c8e8435466f4aaa91f233c3278f77c24eaa6b33e69e8f7f1
SHA512

bc17fc3a4a8dffde3fa48c3009a19c2fccf852100f5c1061fc60695e61fddd590c77819b239d673f1592d00ab3b3e056b8d95ed550b1e15d958a0b3dff51dcd1
SSDEEP

6144:Qu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Gbv:Qu7wNB5iedQ1RmPEVAWONjpcs/ZpSbv

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/732-11-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/732-18-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/1816-40-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4340-12-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4340-14-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4340-30-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4340-50-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2812-51-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 12 IoCs

resource	yara_rule
behavioral2/memory/4340-12-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/732-11-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4152-9-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4152-13-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4340-14-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/732-18-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4152-19-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4340-30-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1816-40-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4184-44-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4340-50-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2812-51-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	tmp.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	tmp.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3548 set thread context of 4340	3548	tmp.exe	84
PID 3548 set thread context of 732	3548	tmp.exe	85
PID 3548 set thread context of 4152	3548	tmp.exe	86
PID 3548 set thread context of 2812	3548	tmp.exe	91
PID 3548 set thread context of 1816	3548	tmp.exe	92
PID 3548 set thread context of 4184	3548	tmp.exe	93

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4340	tmp.exe
4340	tmp.exe
4152	tmp.exe
4152	tmp.exe
2812	tmp.exe
2812	tmp.exe
4184	tmp.exe
4184	tmp.exe
4340	tmp.exe
4340	tmp.exe
2812	tmp.exe
2812	tmp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3548	tmp.exe
3548	tmp.exe
3548	tmp.exe
3548	tmp.exe
3548	tmp.exe
3548	tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	tmp.exe
Token: SeDebugPrivilege	4184	tmp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3548	tmp.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4340	3548	tmp.exe	84
PID 3548 wrote to memory of 4340	3548	tmp.exe	84
PID 3548 wrote to memory of 4340	3548	tmp.exe	84
PID 3548 wrote to memory of 732	3548	tmp.exe	85
PID 3548 wrote to memory of 732	3548	tmp.exe	85
PID 3548 wrote to memory of 732	3548	tmp.exe	85
PID 3548 wrote to memory of 4152	3548	tmp.exe	86
PID 3548 wrote to memory of 4152	3548	tmp.exe	86
PID 3548 wrote to memory of 4152	3548	tmp.exe	86
PID 3548 wrote to memory of 2812	3548	tmp.exe	91
PID 3548 wrote to memory of 2812	3548	tmp.exe	91
PID 3548 wrote to memory of 2812	3548	tmp.exe	91
PID 3548 wrote to memory of 1816	3548	tmp.exe	92
PID 3548 wrote to memory of 1816	3548	tmp.exe	92
PID 3548 wrote to memory of 1816	3548	tmp.exe	92
PID 3548 wrote to memory of 4184	3548	tmp.exe	93
PID 3548 wrote to memory of 4184	3548	tmp.exe	93
PID 3548 wrote to memory of 4184	3548	tmp.exe	93

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\cixfosgizncvda"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\nkdypkrknvuanoxaj"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:732
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\peqiidbdbdmepvleandmj"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\jteamkopo"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\unrsncyrciil"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\epwlgurkyyapoqas"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jteamkopo

Filesize
4KB

MD5
28cfa3f332aaea0dbc2c6b239ae55629

SHA1
69508ce857a1b4d2643967fa5438330fc5a919c3

SHA256
f53cfdd9e5697f08e83d67f2b7436f116fa6fea044d3a7ac09e9f4257a148e85

SHA512
2fdbb194c93111dc5c26df24a7e2d5a0994d05286b4541e09180a2fceb653f86cc6e7a8ed5ad1d1d461a280ab5c015aadbfb4e6c0f98aea6cb78828ffe288e54

Download Submit
memory/732-11-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/732-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/732-18-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/732-8-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1816-40-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2812-51-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3548-59-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3548-58-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3548-55-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3548-60-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3548-61-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3548-62-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4152-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4152-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4152-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4152-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4152-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4184-43-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download
memory/4184-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4340-30-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4340-50-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4340-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4340-14-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4340-12-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4340-7-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing