Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
92c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
36s -
max time network
199s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
2c01b007729230c415420ad641ad92eb.exe
-
Size
1.3MB
-
MD5
daef338f9c47d5394b7e1e60ce38d02d
-
SHA1
c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e
-
SHA256
5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58
-
SHA512
d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4
-
SSDEEP
24576:W85y6Jwdt8jtWoJpXWHALGX+C1Co3aP8jvuC7g6zwm4m53Sb21SR:HXsSGuC/MIvuC5kFm53Sy1SR
Malware Config
Signatures
-
NirSoft MailPassView 9 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral11/memory/2432-109-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/2432-108-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/2432-107-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/2432-104-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/2432-102-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/1100-121-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral11/memory/1100-124-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral11/memory/1100-123-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral11/memory/1100-125-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 9 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral11/memory/2432-109-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/2432-108-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/2432-107-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/2432-104-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/2432-102-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/2448-126-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral11/memory/2448-129-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral11/memory/2448-127-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral11/memory/2448-135-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 13 IoCs
Processes:
resource yara_rule behavioral11/memory/2432-109-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/2432-108-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/2432-107-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/2432-104-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/2432-102-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/1100-121-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1100-124-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1100-123-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1100-125-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/2448-126-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral11/memory/2448-129-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral11/memory/2448-127-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral11/memory/2448-135-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 whatismyipaddress.com 4 whatismyipaddress.com 5 whatismyipaddress.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"1⤵PID:2596
-
C:\Users\Admin\AppData\Roaming\wou\odm.exe"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex2⤵PID:1800
-
C:\Users\Admin\AppData\Roaming\wou\odm.exeC:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HXUIA3⤵PID:1976
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵PID:2432
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵PID:1100
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵PID:2448
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeC:\Users\Admin\AppData\Roaming\wou\HXUIA4⤵PID:2096
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵PID:2876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
91KB
MD59375872d82fbfe00eb4f6e608aa170d8
SHA1b6d6f7059c025075141293cc0c1f80c1063ef75b
SHA256a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9
SHA512f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863
-
Filesize
1KB
MD5f6efac00916f3425d6079ae5a956df11
SHA13153abfe46186c1186882f67444c82c544615fb7
SHA2561e866a8f06f125fa1c439f9cb00199be827e74b87eae12368bd1e2cf7ab28728
SHA5120ba766d5816057941ad9afc80f7b20620b0120411357fe2b97ab0a425b32d4309396ed4866c8b23c92893ed68971c4a8a8c6f25ffa411ba0c70b602a63bd4743
-
Filesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
Filesize
1.2MB
MD5a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA17a082661c9a3431cd89ed4d9959178d60b9570f7
SHA2567da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
16KB
MD56285049d1e4f854943856164652da8d8
SHA1f29c791ddb940be594bfb431eca7d4cb6d9e2688
SHA2560aeb7e8a131b53991567db463519ea005d41ddd1f227a744d4f7066805ce684f
SHA5122bb954a07f82c19b26d745ac19cd66e6eb82c525db0bd6e9e6880b0077465897d7fc49521d40361262c9dccdba4de6cead5b7d8dc09a9beaae2d668537097291