2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc

Analysis

max time kernel
298s
max time network
287s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/06/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
Size 483KB
Sample240606-219avaed24
SHA256 2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc
MD5 f30c1b5518a0ed1811c73a68986ffb97
SHA1 f8226096b0d6d8d50a835d2340d2cda9586ddbec
SHA512 4e91fc21d1556600d301079a88a5146c7739d32007cbadfd6fd3194d2e2355f51c3fb7f0ad1ce94c60f83188da75e6baa9cab990789aa85a0f2766c0aa7acddf
SSDEEP 6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNV5Gv:6X7tPMK8ctGe4Dzl4h2QnuPs/ZDMcv
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4276-12-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4276-20-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4276-10-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4628-21-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4628-19-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4628-26-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 9 IoCs

resource	yara_rule
behavioral2/memory/4276-12-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4628-21-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4628-19-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4276-20-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2712-16-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4276-10-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2712-9-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2712-13-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4628-26-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3376 set thread context of 4628	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	73
PID 3376 set thread context of 4276	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	74
PID 3376 set thread context of 2712	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	75

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2712	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
2712	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
4628	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
4628	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
4628	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
4628	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4628	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	73
PID 3376 wrote to memory of 4628	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	73
PID 3376 wrote to memory of 4628	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	73
PID 3376 wrote to memory of 4276	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	74
PID 3376 wrote to memory of 4276	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	74
PID 3376 wrote to memory of 4276	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	74
PID 3376 wrote to memory of 2712	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	75
PID 3376 wrote to memory of 2712	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	75
PID 3376 wrote to memory of 2712	3376	2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe	75

C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
"C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
  C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe /stext "C:\Users\Admin\AppData\Local\Temp\odeeibruskkxmigxwjhftviiringsbyo"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
  C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe /stext "C:\Users\Admin\AppData\Local\Temp\zxjx"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe
  C:\Users\Admin\AppData\Local\Temp\2643d62ddadfd823c1c72986f1e6a444ee983fa086a4fc883740246fb483dfdc.exe /stext "C:\Users\Admin\AppData\Local\Temp\bzpijmnq"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 5d1fa6b8fbe872f79c082f3aa3b8a08c31f4455b2563f8e8442ae3c7462f38ae
MD5 13ffd87ec95af555ad2f44ec5e08cd7a
SHA1 710a835393705f86ef5c93d613211f76099599f1
SHA512 c4d71e202122aeae7cd4796adc0d23dac4fa2d5133005806181de59d2f41fd17b3d0459b95d6cfe52f2599237632fb32df5bd98ac7e5aa190349faf64470aac9
MD5 SHA1 SHA512

Submit Download

odeeibruskkxmigxwjhftviiringsbyo

Path C:\Users\Admin\AppData\Local\Temp\odeeibruskkxmigxwjhftviiringsbyo
Size 4KB
SHA256 4bcd9431ddec18b317d0846b2aba64b064b54ea2639e64388ea00f6e559dbb34
MD5 00ab65283d294d9d0cc69dfd2b486caf
SHA1 804478c60330b8c19cc3a7cb2ceb906c0f32347c
SHA512 996ac8923c5b911b7716e4873590fd32a47bf0ccc53cd1476f6f276ba3b9777e490218bca05c16135c8ed70b9c0b86782273ab6748d80b7d67c0160abb3e922f
SSDEEP 48:wvvv02xfvvc2xfdvv02xBvv02xakvv027:mvTxvrp1vTPvTbvT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2712-7-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-13-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-14-0x0000000000430000-0x00000000004F5000-memory.dmp

Download

memory/2712-9-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-8-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3376-29-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3376-32-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3376-33-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4276-10-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4276-6-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4276-2-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4276-12-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4276-20-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4628-1-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4628-26-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4628-11-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4628-19-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4628-21-0x0000000000400000-0x0000000000478000-memory.dmp

Download