3f6fb41bb27d0a85a4ea5e8ddc2723b966c7ff40ea511b31b5efb482efb6bdc8

General

Target
Order_20201001.exe
Size 500KB
Sample200624-eqc94mdwqs
SHA256 3f6fb41bb27d0a85a4ea5e8ddc2723b966c7ff40ea511b31b5efb482efb6bdc8
MD5 2316011484676824177e08c7a2fe8cdf
SHA1 cd4fcb87e921115025d3e06e03f30b4792ecac09
SHA512 23183c3c2ea0fac3df33b036d1a1ac5dae0b17d29c9b9f7699c0792d211c51188fc7640b647deeb0402f988c4401dfa7f4f203537d1bdcf0fb60c239eeb7b902
MD5 SHA1 SHA512

Score

7^/10

spyware

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 520	3544	Order_20201001.exe	73
PID 3544 wrote to memory of 520	3544	Order_20201001.exe	73
PID 3544 wrote to memory of 520	3544	Order_20201001.exe	73
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75
PID 3544 wrote to memory of 804	3544	Order_20201001.exe	75

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	Order_20201001.exe
Token: SeDebugPrivilege	804	Order_20201001.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
804	Order_20201001.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
520	schtasks.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3544 set thread context of 804	3544	Order_20201001.exe	75

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Order_20201001.exe
"C:\Users\Admin\AppData\Local\Temp\Order_20201001.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3544
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fcXVscZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B6D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:520
- C:\Users\Admin\AppData\Local\Temp\Order_20201001.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:804