Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c336ac83a68f17aa2963c9bf6c2d293.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c336ac83a68f17aa2963c9bf6c2d293.exe
Resource
win10v2004-20231222-en
5 signatures
150 seconds
General
-
Target
0c336ac83a68f17aa2963c9bf6c2d293.exe
-
Size
884KB
-
MD5
0c336ac83a68f17aa2963c9bf6c2d293
-
SHA1
b1e7023620d32dbee409077b3de0e68d2fb4d1b3
-
SHA256
32ffa4dd8a62bd9a1f8d5bf3b5802dc038cef4bc06a3664e7e44d5a85a9f1d1c
-
SHA512
6e5945ab3fad543abd6abe8fc9842919fea00644edf0bd3e0de2f4ce73bb0f906ff20f073cf443c165d452a2c902949ebb7ab67afa29055bfe2686ae392707ef
-
SSDEEP
24576:Zyi5BXQyi5BX/9KkAHo8jsB9lhb21CdmuonPH19XGdc+Nk:ZlXQlXGIasBPhLR6WdJNk
Score
9/10
Malware Config
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/444-2-0x0000000000400000-0x00000000004CA000-memory.dmp MailPassView behavioral2/memory/444-4-0x0000000000400000-0x00000000004CA000-memory.dmp MailPassView behavioral2/memory/444-7-0x0000000000400000-0x00000000004CA000-memory.dmp MailPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral2/memory/444-2-0x0000000000400000-0x00000000004CA000-memory.dmp Nirsoft behavioral2/memory/444-4-0x0000000000400000-0x00000000004CA000-memory.dmp Nirsoft behavioral2/memory/444-7-0x0000000000400000-0x00000000004CA000-memory.dmp Nirsoft -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4112 set thread context of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 444 0c336ac83a68f17aa2963c9bf6c2d293.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93 PID 4112 wrote to memory of 444 4112 0c336ac83a68f17aa2963c9bf6c2d293.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c336ac83a68f17aa2963c9bf6c2d293.exe"C:\Users\Admin\AppData\Local\Temp\0c336ac83a68f17aa2963c9bf6c2d293.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\0c336ac83a68f17aa2963c9bf6c2d293.exe"C:\Users\Admin\AppData\Local\Temp\0c336ac83a68f17aa2963c9bf6c2d293.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:444
-