Overview

overview

10

Static

static

10

2976-34-0x...ry.exe

windows7-x64

9

2976-34-0x...ry.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2024 08:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2976-34-0x0000000000400000-0x0000000000417000-memory.exe

  • Size

    92KB

  • MD5

    be359e977e4f84e90d66703d7db01e20

  • SHA1

    786123e05622a4faa70dbef725b0af0fc45641d6

  • SHA256

    d680f58a9803eb57e4564754e91fbad12f92a0850d14cb6e0b145d868edaa213

  • SHA512

    37a24484cdc3ad36bf1938582b6f2575487934ba0f5f2a427b108fe517115415a53d692accc13a1b572582df375ff90ff3812fea78e6851d204f59976a3a0af2

  • SSDEEP

    1536:ohhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESKFNTh9E+JP19qkPIhS:uhzYTGWVvJ8f2v1TbPzuMsIFScNThy+B

Score
9/10
collectionspywarestealer

Malware Config

Signatures

  • NirSoft MailPassView 6 IoCs

    Password recovery tool for various email clients

  • Nirsoft 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\gpnbdkkjwffbfloxwfedmqpc"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3000
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\jkauecvlsnxnprcbfqrfxvjtvug"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\tmfffvgegvpssgynobdyahwcwjqrlc"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:2804
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\iipwyan"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\skugytxdvwq"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1428
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\veizzdiwjeipcu"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:2404
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\ptwqvkciebmiovonlztyrkmjlodtoxhrk"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2928
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\anjjwc"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:772
    • C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe
      C:\Users\Admin\AppData\Local\Temp\2976-34-0x0000000000400000-0x0000000000417000-memory.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqobxvydg"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:1108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\iipwyan
    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    Download Submit
  • memory/772-149-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1108-152-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1428-81-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1428-102-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1616-73-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/1616-96-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/1616-80-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/1964-13-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-37-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-46-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-16-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-11-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-21-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-15-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-25-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-23-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/1964-22-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/2404-105-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2404-98-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-51-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-31-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-42-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-43-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-41-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-40-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-27-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-29-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-35-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2804-32-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2928-144-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-1-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-20-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-50-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-10-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-36-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-24-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-3-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-5-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-6-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-26-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

    Download
  • memory/3000-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

    Download