Analysis
-
max time kernel
101s -
max time network
118s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 06:03
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice Ref 48934.Scan.exe
Resource
win7
Behavioral task
behavioral2
Sample
Payment Advice Ref 48934.Scan.exe
Resource
win10
General
-
Target
Payment Advice Ref 48934.Scan.exe
-
Size
614KB
-
MD5
6aa28009d12060937abbbf9d31abc84e
-
SHA1
3f3abac76649190d520f48de99e694c94ede3fd9
-
SHA256
61c7750e724cbe16f38b96cb8118daac29977ce677bade5f7c215a6b97b16d84
-
SHA512
ca4944e0a44335ebfe8404f9902bfc31a4470e7c913afd4e4bc8c9762373c76911f2554b41f5f63c40ac558be23bcd000fde69c1c96eac22ed31a81ec4c03250
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Payment Advice Ref 48934.Scan.exedescription pid process target process PID 3588 wrote to memory of 3820 3588 Payment Advice Ref 48934.Scan.exe schtasks.exe PID 3588 wrote to memory of 3820 3588 Payment Advice Ref 48934.Scan.exe schtasks.exe PID 3588 wrote to memory of 3820 3588 Payment Advice Ref 48934.Scan.exe schtasks.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe PID 3588 wrote to memory of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Advice Ref 48934.Scan.exedescription pid process target process PID 3588 set thread context of 3892 3588 Payment Advice Ref 48934.Scan.exe Payment Advice Ref 48934.Scan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Advice Ref 48934.Scan.exedescription pid process Token: SeDebugPrivilege 3892 Payment Advice Ref 48934.Scan.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Payment Advice Ref 48934.Scan.exepid process 3892 Payment Advice Ref 48934.Scan.exe 3892 Payment Advice Ref 48934.Scan.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Payment Advice Ref 48934.Scan.exepid process 3892 Payment Advice Ref 48934.Scan.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice Ref 48934.Scan.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice Ref 48934.Scan.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3588 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sPFJeTXeixgz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E4E.tmp"2⤵
- Creates scheduled task(s)
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\Payment Advice Ref 48934.Scan.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3892