Analysis
-
max time kernel
141s -
max time network
22s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 10:10
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Payment Advice.exe
Resource
win10
General
-
Target
Payment Advice.exe
-
Size
827KB
-
MD5
6846e1d5a6d02a9b967ca1bd18ef6ba8
-
SHA1
7d645454a187ba2914e5cab6bb83db0a20615fa5
-
SHA256
528f29b705ad29a6e607a93fe7f16ddd4725f19f0e9d32cbc505f14d20a52787
-
SHA512
53696492fe9a25d7f07e208b489c14235b1180e830282ab52da54ced3322b78c6ae10025404965f271c902669545fd1df4e226652e72670330dcf98bf992ae6f
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe PID 1520 wrote to memory of 1800 1520 Payment Advice.exe Payment Advice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Advice.exedescription pid process Token: SeDebugPrivilege 1800 Payment Advice.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Payment Advice.exepid process 1800 Payment Advice.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Advice.exedescription pid process target process PID 1520 set thread context of 1800 1520 Payment Advice.exe Payment Advice.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Payment Advice.exepid process 1800 Payment Advice.exe 1800 Payment Advice.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1800