e582b99d0e9ea6b9ee35cc35923ea7c093caf49f3a260091e499ea70924fc423

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b73654cf36400f07cca37f59c1f3045.exe
Size 1.2MB
Sample240826-v3pkwswele
SHA256 e582b99d0e9ea6b9ee35cc35923ea7c093caf49f3a260091e499ea70924fc423
MD5 4b73654cf36400f07cca37f59c1f3045
SHA1 f48126fe67484770f48c5a4154b72767a047d128
SHA512 e7a07b28cecaba8289bd2aa6b551bb25bc09f858f3fb4a33cda65a9e3dacb248c1a7189edf2c6b44eff2d167b8ad0dc1c78548f86370a581c321369bf654d9b6
SSDEEP 24576:CZVuHRMORLbIddddazvtyrSjX/f3RxyKs7smnUhvZg2ECLdr9wZaQWlHSb:UwRMOJbIddddaQU/f3Rxla/Uh5ECRDB2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection credential_access discovery persistence stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3428 created 3444	3428	4b73654cf36400f07cca37f59c1f3045.exe	56

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2764-1123-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2828-1119-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2764-1127-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2828-1129-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2764-1123-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/2764-1127-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2828-1119-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2828-1129-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gojxamxsp = "C:\\Users\\Admin\\AppData\\Roaming\\Gojxamxsp.exe"	4b73654cf36400f07cca37f59c1f3045.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3428 set thread context of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 2296 set thread context of 2828	2296	InstallUtil.exe	95
PID 2296 set thread context of 2764	2296	InstallUtil.exe	96
PID 2296 set thread context of 1980	2296	InstallUtil.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b73654cf36400f07cca37f59c1f3045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3428	4b73654cf36400f07cca37f59c1f3045.exe
2828	InstallUtil.exe
2828	InstallUtil.exe
1980	InstallUtil.exe
1980	InstallUtil.exe
2828	InstallUtil.exe
2828	InstallUtil.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2296	InstallUtil.exe
2296	InstallUtil.exe
2296	InstallUtil.exe
2296	InstallUtil.exe
2296	InstallUtil.exe
2296	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	4b73654cf36400f07cca37f59c1f3045.exe
Token: SeDebugPrivilege	3428	4b73654cf36400f07cca37f59c1f3045.exe
Token: SeDebugPrivilege	1980	InstallUtil.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 3428 wrote to memory of 2296	3428	4b73654cf36400f07cca37f59c1f3045.exe	87
PID 2296 wrote to memory of 2828	2296	InstallUtil.exe	95
PID 2296 wrote to memory of 2828	2296	InstallUtil.exe	95
PID 2296 wrote to memory of 2828	2296	InstallUtil.exe	95
PID 2296 wrote to memory of 2828	2296	InstallUtil.exe	95
PID 2296 wrote to memory of 2764	2296	InstallUtil.exe	96
PID 2296 wrote to memory of 2764	2296	InstallUtil.exe	96
PID 2296 wrote to memory of 2764	2296	InstallUtil.exe	96
PID 2296 wrote to memory of 2764	2296	InstallUtil.exe	96
PID 2296 wrote to memory of 100	2296	InstallUtil.exe	97
PID 2296 wrote to memory of 100	2296	InstallUtil.exe	97
PID 2296 wrote to memory of 100	2296	InstallUtil.exe	97
PID 2296 wrote to memory of 1188	2296	InstallUtil.exe	98
PID 2296 wrote to memory of 1188	2296	InstallUtil.exe	98
PID 2296 wrote to memory of 1188	2296	InstallUtil.exe	98
PID 2296 wrote to memory of 2804	2296	InstallUtil.exe	99
PID 2296 wrote to memory of 2804	2296	InstallUtil.exe	99
PID 2296 wrote to memory of 2804	2296	InstallUtil.exe	99
PID 2296 wrote to memory of 1980	2296	InstallUtil.exe	100
PID 2296 wrote to memory of 1980	2296	InstallUtil.exe	100
PID 2296 wrote to memory of 1980	2296	InstallUtil.exe	100
PID 2296 wrote to memory of 1980	2296	InstallUtil.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\4b73654cf36400f07cca37f59c1f3045.exe
  "C:\Users\Admin\AppData\Local\Temp\4b73654cf36400f07cca37f59c1f3045.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\msyjkjemecyz"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2828
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\omdbdtpfskqmwsb"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\zoiudlahosiqygxmuz"
    3⤵
    PID:100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\zoiudlahosiqygxmuz"
    3⤵
    PID:1188
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\zoiudlahosiqygxmuz"
    3⤵
    PID:2804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\zoiudlahosiqygxmuz"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msyjkjemecyz

Path C:\Users\Admin\AppData\Local\Temp\msyjkjemecyz
Size 4KB
SHA256 a6c43b4e4b8681cf0ef56c49c730fa77e34dc82db0260253a3ba75039030b9ec
MD5 1891919175c888ce82e9bd8a047b01ad
SHA1 502a6892a5d27ecb791ac5aa6d8586944f540453
SHA512 8bb940050b1abf6c27db133ed446f41e108f670f361ed5102408832ce33d9b87cd0880723441f1632292eeeb0a319c4e0fac0ea659eb55ebe1130cc3e6c776a3
SSDEEP 48:wvvv0GxxfvvcGxxfdvv0GxxBvv0Gxxakvv0Gx7:mvtxxvlxp1vtxPvtxbvtx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2764-1123-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2764-1127-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2828-1119-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2828-1129-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3428-36-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-64-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-2-0x0000000005860000-0x000000000597C000-memory.dmp

Download

memory/3428-3-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3428-4-0x0000000005AF0000-0x0000000005C0E000-memory.dmp

Download

memory/3428-16-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-14-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-62-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-68-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-28-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-30-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-60-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-58-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-56-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-54-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-52-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-50-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-49-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-46-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-44-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-42-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-0-0x00000000748FE000-0x00000000748FF000-memory.dmp

Download

memory/3428-1-0x0000000000F10000-0x000000000103E000-memory.dmp

Download

memory/3428-34-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-66-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-26-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-24-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-22-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-20-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-18-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-12-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-8-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-40-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-38-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-32-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-5-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-10-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-6-0x0000000005AF0000-0x0000000005C07000-memory.dmp

Download

memory/3428-1077-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3428-1078-0x0000000005DE0000-0x0000000005E78000-memory.dmp

Download

memory/3428-1079-0x0000000005C90000-0x0000000005CDC000-memory.dmp

Download

memory/3428-1083-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3428-1084-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3428-1085-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3428-1086-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3428-1087-0x00000000066F0000-0x0000000006C94000-memory.dmp

Download

memory/3428-1088-0x0000000006060000-0x00000000060B4000-memory.dmp

Download

memory/3428-1103-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download