Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Bank Statement_pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
Bank Statement_pdf.exe
Resource
win10
General
-
Target
Bank Statement_pdf.exe
-
Size
899KB
-
MD5
1c3985f5c3ad3e9a5394d093237ecd72
-
SHA1
9d3c319ac9c93ed1227c7808f8a8a16b935a6fcf
-
SHA256
e91593299dba4d7f9362c8d64e701413af0384f0f7ecca356ab138497f3a8e4d
-
SHA512
3f3ce2ddac434d8bc8cb8f5c376b31e63d54ccfb809907542bb5b0f6094a01049ba6e15e20e5c6b3af815248e3ec6ea1993194b68eeb78743fd88c7ec5037511
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Bank Statement_pdf.exeBank Statement_pdf.exepid process 1612 Bank Statement_pdf.exe 1116 Bank Statement_pdf.exe 1116 Bank Statement_pdf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Bank Statement_pdf.exepid process 1612 Bank Statement_pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bank Statement_pdf.exedescription pid process target process PID 1612 set thread context of 1116 1612 Bank Statement_pdf.exe Bank Statement_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Bank Statement_pdf.exedescription pid process Token: SeDebugPrivilege 1116 Bank Statement_pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Bank Statement_pdf.exepid process 1116 Bank Statement_pdf.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Bank Statement_pdf.exepid process 1116 Bank Statement_pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Bank Statement_pdf.exedescription pid process target process PID 1612 wrote to memory of 1116 1612 Bank Statement_pdf.exe Bank Statement_pdf.exe PID 1612 wrote to memory of 1116 1612 Bank Statement_pdf.exe Bank Statement_pdf.exe PID 1612 wrote to memory of 1116 1612 Bank Statement_pdf.exe Bank Statement_pdf.exe PID 1612 wrote to memory of 1116 1612 Bank Statement_pdf.exe Bank Statement_pdf.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral1/memory/1116-0-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1116-2-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1116-3-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1116-0-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1116-1-0x000000000053FAE0-mapping.dmp
-
memory/1116-2-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1116-3-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1116-4-0x00000000005F0000-0x000000000068A000-memory.dmpFilesize
616KB
-
memory/1116-5-0x0000000002032000-0x0000000002033000-memory.dmpFilesize
4KB
-
memory/1116-6-0x0000000000260000-0x00000000002F4000-memory.dmpFilesize
592KB