37859468e6f4a77939f08daeab868b4da51c1a506334dc85908d2c29b0d977fc

General

Target
SWIFTpayment47547745776.bat.exe
Size 545KB
Sample200707-n552afltts
SHA256 37859468e6f4a77939f08daeab868b4da51c1a506334dc85908d2c29b0d977fc
MD5 68b0764829912d9ecd36633377da29bc
SHA1 17ab0f2b63d6e723be24ac44874c3a86e01186b5
SHA512 fedc6097a4f8ef57664ef45fcfcec227ee1a6c1bc894effc43cd32ff3982f89c401efdddc713d0ad4046ace3a7f8a4bf023bd9c007f188a514847227acfa3c15
MD5 SHA1 SHA512

Score

7^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3840	3068	SWIFTpayment47547745776.bat.exe	67
PID 3068 wrote to memory of 3840	3068	SWIFTpayment47547745776.bat.exe	67
PID 3068 wrote to memory of 3840	3068	SWIFTpayment47547745776.bat.exe	67
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68
PID 3068 wrote to memory of 3820	3068	SWIFTpayment47547745776.bat.exe	68

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	SWIFTpayment47547745776.bat.exe
Token: SeDebugPrivilege	3820	SWIFTpayment47547745776.bat.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 3820	3068	SWIFTpayment47547745776.bat.exe	68

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3820	SWIFTpayment47547745776.bat.exe

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngnIl = "C:\\Users\\Admin\\AppData\\Roaming\\ngnIl\\ngnIl.exe"	SWIFTpayment47547745776.bat.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\SWIFTpayment47547745776.bat.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFTpayment47547745776.bat.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3068
- C:\Users\Admin\AppData\Local\Temp\SWIFTpayment47547745776.bat.exe
  "{path}"
  2⤵
  PID:3840
- C:\Users\Admin\AppData\Local\Temp\SWIFTpayment47547745776.bat.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Adds Run entry to start application
  PID:3820