Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 08:29
Static task
static1
Behavioral task
behavioral1
Sample
payment.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payment.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
payment.exe
-
Size
479KB
-
MD5
c7c93dec3793f885f2989f6b6e8cef69
-
SHA1
91aad3b2300b4212482a8bf15ce87d8832c359f5
-
SHA256
a26b0b8ed3e9a7159a68553861239c8ba255afcf36fc645d33bc3a36b7849496
-
SHA512
ae715317b33950cd5fa62572a4dea7cbb63a62281f3e7b224654be713fb6afa2820d1acc890ce861251d353ce065da5a40e0c49d51c92acea55c5526a5b6289c
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 284 wrote to memory of 1032 284 payment.exe 24 PID 284 wrote to memory of 1032 284 payment.exe 24 PID 284 wrote to memory of 1032 284 payment.exe 24 PID 284 wrote to memory of 1032 284 payment.exe 24 PID 284 wrote to memory of 1032 284 payment.exe 24 PID 284 wrote to memory of 1032 284 payment.exe 24 PID 284 wrote to memory of 1032 284 payment.exe 24 PID 1268 wrote to memory of 1092 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1092 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1092 1268 Explorer.EXE 25 PID 1268 wrote to memory of 1092 1268 Explorer.EXE 25 PID 1092 wrote to memory of 1644 1092 raserver.exe 26 PID 1092 wrote to memory of 1644 1092 raserver.exe 26 PID 1092 wrote to memory of 1644 1092 raserver.exe 26 PID 1092 wrote to memory of 1644 1092 raserver.exe 26 PID 1092 wrote to memory of 1620 1092 raserver.exe 31 PID 1092 wrote to memory of 1620 1092 raserver.exe 31 PID 1092 wrote to memory of 1620 1092 raserver.exe 31 PID 1092 wrote to memory of 1620 1092 raserver.exe 31 PID 1092 wrote to memory of 1620 1092 raserver.exe 31 -
Executes dropped EXE 1 IoCs
pid Process 1032 AddInProcess32.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\K6D0BVQ8WLK = "C:\\Program Files (x86)\\Ekpx0cfw0\\configdpwtjleh.exe" raserver.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 284 payment.exe Token: SeDebugPrivilege 1032 AddInProcess32.exe Token: SeDebugPrivilege 1092 raserver.exe -
Loads dropped DLL 1 IoCs
pid Process 284 payment.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 284 set thread context of 1032 284 payment.exe 24 PID 1032 set thread context of 1268 1032 AddInProcess32.exe 20 PID 1092 set thread context of 1268 1092 raserver.exe 20 -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1032 AddInProcess32.exe 1032 AddInProcess32.exe 1032 AddInProcess32.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ekpx0cfw0\configdpwtjleh.exe raserver.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 284 payment.exe 284 payment.exe 284 payment.exe 1032 AddInProcess32.exe 1032 AddInProcess32.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe 1092 raserver.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\payment.exe"C:\Users\Admin\AppData\Local\Temp\payment.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:284 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1092 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵PID:1644
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1620
-
-