f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe
Size 483KB
Sample240531-lyjpeaef75
SHA256 f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5
MD5 7f71aa611a47436a942fd26375dee76d
SHA1 ea47d8945b5b9fa39f401345fda7308d5dd17ae0
SHA512 5805981f2499d93863b9664fcc2c5773a3fce81038b834f02d3ef00a8ea1b9e8397550014a18da820fffd9f224d884d9aab15a211f2b738685b34cdf7e68e722
SSDEEP 6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNU5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/Zs1cv
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

collection persistence spyware stealer

Malware Config

Signatures

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4620-32-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/4620-27-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1756-33-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1756-28-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1756-39-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral2/memory/4144-24-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4144-31-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1756-33-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4620-32-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/1756-28-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4620-27-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4144-25-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1756-39-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe

Executes dropped EXE 4 IoCs

pid	Process
1780	AnyDesk.exe
1756	AnyDesk.exe
4620	AnyDesk.exe
4144	AnyDesk.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AnyDesk.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AnyDesk-8BNQK6 = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\""	f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AnyDesk-8BNQK6 = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\""	f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AnyDesk-8BNQK6 = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\""	AnyDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AnyDesk-8BNQK6 = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\""	AnyDesk.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 1756	1780	AnyDesk.exe	97
PID 1780 set thread context of 4620	1780	AnyDesk.exe	98
PID 1780 set thread context of 4144	1780	AnyDesk.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4144	AnyDesk.exe
4144	AnyDesk.exe
1756	AnyDesk.exe
1756	AnyDesk.exe
1756	AnyDesk.exe
1756	AnyDesk.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1780	AnyDesk.exe
1780	AnyDesk.exe
1780	AnyDesk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	AnyDesk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1780	AnyDesk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1780	3300	f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe	83
PID 3300 wrote to memory of 1780	3300	f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe	83
PID 3300 wrote to memory of 1780	3300	f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe	83
PID 1780 wrote to memory of 1756	1780	AnyDesk.exe	97
PID 1780 wrote to memory of 1756	1780	AnyDesk.exe	97
PID 1780 wrote to memory of 1756	1780	AnyDesk.exe	97
PID 1780 wrote to memory of 4620	1780	AnyDesk.exe	98
PID 1780 wrote to memory of 4620	1780	AnyDesk.exe	98
PID 1780 wrote to memory of 4620	1780	AnyDesk.exe	98
PID 1780 wrote to memory of 4144	1780	AnyDesk.exe	99
PID 1780 wrote to memory of 4144	1780	AnyDesk.exe	99
PID 1780 wrote to memory of 4144	1780	AnyDesk.exe	99

C:\Users\Admin\AppData\Local\Temp\f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe
"C:\Users\Admin\AppData\Local\Temp\f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3300
- C:\ProgramData\AnyDesk\AnyDesk.exe
  "C:\ProgramData\AnyDesk\AnyDesk.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\ProgramData\AnyDesk\AnyDesk.exe
    C:\ProgramData\AnyDesk\AnyDesk.exe /stext "C:\Users\Admin\AppData\Local\Temp\faiuxjbroqjrvwhomymlrvasmoejeqajzz"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1756
- - C:\ProgramData\AnyDesk\AnyDesk.exe
    C:\ProgramData\AnyDesk\AnyDesk.exe /stext "C:\Users\Admin\AppData\Local\Temp\pvnnxbm"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    PID:4620
- - C:\ProgramData\AnyDesk\AnyDesk.exe
    C:\ProgramData\AnyDesk\AnyDesk.exe /stext "C:\Users\Admin\AppData\Local\Temp\axagytwmyh"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AnyDesk.exe

Path C:\ProgramData\AnyDesk\AnyDesk.exe
Size 483KB
SHA256 f1d7b16d00a5c3e65ce0c498b567fe70ba334c1c51c58144cf8e7966b126c8c5
MD5 7f71aa611a47436a942fd26375dee76d
SHA1 ea47d8945b5b9fa39f401345fda7308d5dd17ae0
SHA512 5805981f2499d93863b9664fcc2c5773a3fce81038b834f02d3ef00a8ea1b9e8397550014a18da820fffd9f224d884d9aab15a211f2b738685b34cdf7e68e722
SSDEEP 6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNU5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/Zs1cv
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\ProgramData\AnyDesk\logs.dat
Size 144B
SHA256 2dda7a3268167c2eed0549fd4c253096b84c5d5645e2d68fea6d928ae860ae75
MD5 cfb63fc2d4afbdccc02f31e8f56a1f63
SHA1 56d61a5dd4e62fd36490581bea928156a0a70c90
SHA512 c82b630773441faa8e50cd2fb3c6ac176386aa514c31695b4e00a6226ec63051f35e2d0a843ac3365f1aeccaec7a58c11ccabd0abadfeb58fbeba14c5968b6c4
MD5 SHA1 SHA512

Submit Download

faiuxjbroqjrvwhomymlrvasmoejeqajzz

Path C:\Users\Admin\AppData\Local\Temp\faiuxjbroqjrvwhomymlrvasmoejeqajzz
Size 4KB
SHA256 0ef9194c6e90b23c416316fc5a15f549ee5b2472014fcd7648d72ca9a865b409
MD5 73ddf6cd83c2ad8a2fbb2383e322ffbc
SHA1 05270f8bb7b5cc6ab9a61ae7453d047379089147
SHA512 714db1956faa795005b15324b9604105881d6b484fe899876fe0df85783c61a72f556a875833af8625625212503b95eea2eb353a1d98f6a7af47a3658ea5262d
SSDEEP 48:wvvv0PxfvvcPxfdvv0PxBvv0Pxakvv0P7:mvCxvqp1vCPvCbvC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1756-39-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1756-17-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1756-33-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1756-11-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1756-28-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1780-45-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1780-42-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1780-46-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4144-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4144-26-0x0000000000430000-0x00000000004F9000-memory.dmp

Download

memory/4144-25-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4144-23-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4144-24-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4144-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4620-27-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4620-14-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4620-22-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4620-32-0x0000000000400000-0x0000000000457000-memory.dmp

Download