Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2024, 14:32

General

  • Target

    2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe

  • Size

    483KB

  • MD5

    7af729eddb701674c575032b14cbb529

  • SHA1

    871fe7c315fb4b3dd8d33ae0b98001207a0c660f

  • SHA256

    2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b

  • SHA512

    e2193ab01bdb9b4e6f1133f4a57cbe211c0fe90dfff44f4ceb0b4ac0c0a5dc3b1944c5e0a295432d8e39acf4511116ca2b959121adf02d234f51f5d0aaecb7b4

  • SSDEEP

    6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNk5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZsNcv

Malware Config

Signatures

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe
    "C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe
      C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe /stext "C:\Users\Admin\AppData\Local\Temp\mhqjyxjrubjuymoblsjcjunxq"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1168
    • C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe
      C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe /stext "C:\Users\Admin\AppData\Local\Temp\xkwczptlqjbzbbcnddweuzhozkzs"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:3008
    • C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe
      C:\Users\Admin\AppData\Local\Temp\2f4d1b809b6f776b81a5c2aba52fb5deb61658b4617b52832f727d64a6d4ea7b.exe /stext "C:\Users\Admin\AppData\Local\Temp\zebuaieeertdlhyrmoqfxluxzzrbzsyb"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4088

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\mhqjyxjrubjuymoblsjcjunxq

          Filesize

          4KB

          MD5

          a4b83bf48e62a41c2f45628d10c5bba1

          SHA1

          2596a41d8da2eb88f7f69e27cc16a046a2287f35

          SHA256

          7b29149f6971b7fba6137f401c2d515cc576dafd233b7d312dd7d818b9f91829

          SHA512

          afcaee732127ad05cc70a2a9cca8e4ccdcacf8161b16ed4c5e346418a7c221f3da4f20d95b449fb813a6ccbd2aad05a3a9449a9db01f8fd5c132068d1cf4c7bd

        • memory/536-32-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/536-31-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/536-30-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/536-28-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/536-25-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/1168-22-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/1168-6-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/1168-1-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/1168-10-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/3008-7-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/3008-17-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/3008-11-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/3008-3-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/4088-20-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/4088-13-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/4088-12-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/4088-4-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB