1984264959b7d63e516544cbce4b6dffb7ed5210a472437dd88068f4d39600e2

General

Target

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
Size

483KB
MD5

3a9fb5399a485d6e94d5ffe6e2349e74
SHA1

9f5438e7296fe2ca8f7efb574e7139923756ceb8
SHA256

1984264959b7d63e516544cbce4b6dffb7ed5210a472437dd88068f4d39600e2
SHA512

955363ff31b0d5225a90452f1e9d676a4c81a21380289381f96206854914fd0a125ffb434b598a28c9d75a210ac2d793e06757e065f4d1d99447d6284ccd712e
SSDEEP

6144:mXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNra5Gv:mX7tPMK8ctGe4Dzl4h2QnuPs/ZDncv

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4044-16-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4044-18-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3152-10-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3152-23-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3152-10-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2164-17-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4044-16-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4044-18-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2164-21-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3152-23-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

description	pid	process	target process
PID 4928 set thread context of 3152	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 set thread context of 4044	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 set thread context of 2164	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

pid	process
3152	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
3152	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
2164	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
2164	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
3152	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
3152	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

pid	process
4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

description pid process

Token: SeDebugPrivilege 2164 1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

description	pid	process
Token: SeDebugPrivilege	2164	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

description	pid	process	target process
PID 4928 wrote to memory of 3152	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 3152	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 3152	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 4044	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 4044	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 4044	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 2164	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 2164	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
PID 4928 wrote to memory of 2164	4928	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe	1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe

C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
"C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4928

C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe /stext "C:\Users\Admin\AppData\Local\Temp\ucbanymjuidbzen"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152

C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe /stext "C:\Users\Admin\AppData\Local\Temp\fehkoqwdiqwfbsbhkc"
2⤵
- Accesses Microsoft Outlook accounts
PID:4044

C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe
C:\Users\Admin\AppData\Local\Temp\1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.exe /stext "C:\Users\Admin\AppData\Local\Temp\hyudojhewyoslzylcngxab"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ucbanymjuidbzen
Filesize
4KB

MD5
a27cc48ff664ae83bb51d1a8661252c8

SHA1
96022695f58e11aa3e6072fcc4ce3b531e8b7d17

SHA256
995240dba7a71256a54567cb8a6783facfec91053c4f2e448535936bbb21c3ca

SHA512
03736a43d31b41a40b2778429746e5b0a6868c0448f16c5743e3dab6c4500ab68a683973c2493ec1609923682bbc81dfe0e73a7a5ba7636dda2eb53b349f02e0

Download Submit
memory/2164-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2164-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2164-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2164-20-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download
memory/2164-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3152-23-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3152-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3152-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3152-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4044-16-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4044-18-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4044-9-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4044-2-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4928-26-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4928-30-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4928-29-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4928-31-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4928-32-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads