Analysis
- max time kernel
298s - max time network
303s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
13/06/2024, 23:58
General
- Target c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exe
- Size 521KB
- Sample240613-31csbawfqd
- SHA256 c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23
Malware Config
Signatures
- NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
- Nirsoft 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exe"C:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exeC:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exe /stext "C:\Users\Admin\AppData\Local\Temp\qfrroxqabxnebeshvnautjxswezpanapd"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exeC:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exe /stext "C:\Users\Admin\AppData\Local\Temp\bzwbp"2⤵
- Accesses Microsoft Outlook accounts
-
-
C:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exeC:\Users\Admin\AppData\Local\Temp\c93b4b7fd43972e40e8977ae4ac460d48e3c5e0ed0362bae7cab64cb052d9b23.exe /stext "C:\Users\Admin\AppData\Local\Temp\lbbuphuv"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
qfrroxqabxnebeshvnautjxswezpanapd
memory/2304-30-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2304-31-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2304-27-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3308-7-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3308-5-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3308-12-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3308-2-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4016-8-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4016-6-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4016-10-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4016-1-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4016-24-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4632-15-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4632-19-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4632-17-0x0000000000430000-0x00000000004F5000-memory.dmp
memory/4632-16-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4632-14-0x0000000000400000-0x0000000000424000-memory.dmp