Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 06:55
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
332KB
-
MD5
ee68d3b0f702077810bddec50179f75d
-
SHA1
e84957da433e6df765486f71391edf69f882f50a
-
SHA256
ee3971f3a905a7bd6126d3d02e0ecaa71bbe41136d3faa0680eec42a4cf20af9
-
SHA512
957eeeef26c139874fc7983078872b491f534ccc447f98d920ac43d11df7b36ffd3cfa1519fb178d6d103a04237b31f4cd5523cedbea778095a93fc0343cebe4
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
STATEMENT OF ACCOUNT.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe STATEMENT OF ACCOUNT.exe -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
STATEMENT OF ACCOUNT.exeRegAsm.exesystray.exepid process 2896 STATEMENT OF ACCOUNT.exe 2896 STATEMENT OF ACCOUNT.exe 2896 STATEMENT OF ACCOUNT.exe 3692 RegAsm.exe 3692 RegAsm.exe 3692 RegAsm.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TJILGNEHOB = "C:\\Program Files (x86)\\Eorudr\\jdpd8vwx1b8.exe" systray.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
RegAsm.exesystray.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3692 RegAsm.exe Token: SeDebugPrivilege 3812 systray.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Drops file in Program Files directory 1 IoCs
Processes:
systray.exedescription ioc process File opened for modification C:\Program Files (x86)\Eorudr\jdpd8vwx1b8.exe systray.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
STATEMENT OF ACCOUNT.exeExplorer.EXEsystray.exedescription pid process target process PID 2896 wrote to memory of 3520 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3520 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3520 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3632 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3632 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3632 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3692 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3692 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3692 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2896 wrote to memory of 3692 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 2984 wrote to memory of 3812 2984 Explorer.EXE systray.exe PID 2984 wrote to memory of 3812 2984 Explorer.EXE systray.exe PID 2984 wrote to memory of 3812 2984 Explorer.EXE systray.exe PID 3812 wrote to memory of 3024 3812 systray.exe cmd.exe PID 3812 wrote to memory of 3024 3812 systray.exe cmd.exe PID 3812 wrote to memory of 3024 3812 systray.exe cmd.exe PID 3812 wrote to memory of 3944 3812 systray.exe cmd.exe PID 3812 wrote to memory of 3944 3812 systray.exe cmd.exe PID 3812 wrote to memory of 3944 3812 systray.exe cmd.exe PID 3812 wrote to memory of 2344 3812 systray.exe Firefox.exe PID 3812 wrote to memory of 2344 3812 systray.exe Firefox.exe PID 3812 wrote to memory of 2344 3812 systray.exe Firefox.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
STATEMENT OF ACCOUNT.exeRegAsm.exesystray.exedescription pid process target process PID 2896 set thread context of 3692 2896 STATEMENT OF ACCOUNT.exe RegAsm.exe PID 3692 set thread context of 2984 3692 RegAsm.exe Explorer.EXE PID 3812 set thread context of 2984 3812 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
RegAsm.exesystray.exepid process 3692 RegAsm.exe 3692 RegAsm.exe 3692 RegAsm.exe 3692 RegAsm.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe 3812 systray.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"2⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2896 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3692 -
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3812 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3024
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3944
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Roaming\5K-1P89C\5K-logim.jpeg
-
C:\Users\Admin\AppData\Roaming\5K-1P89C\5K-logrf.ini
-
C:\Users\Admin\AppData\Roaming\5K-1P89C\5K-logrg.ini
-
C:\Users\Admin\AppData\Roaming\5K-1P89C\5K-logri.ini
-
C:\Users\Admin\AppData\Roaming\5K-1P89C\5K-logrv.ini
-
memory/2344-11-0x0000000000000000-mapping.dmp
-
memory/2344-12-0x00007FF68ECA0000-0x00007FF68ED33000-memory.dmpFilesize
588KB
-
memory/2344-13-0x00007FF68ECA0000-0x00007FF68ED33000-memory.dmpFilesize
588KB
-
memory/2344-14-0x00007FF68ECA0000-0x00007FF68ED33000-memory.dmpFilesize
588KB
-
memory/3024-5-0x0000000000000000-mapping.dmp
-
memory/3692-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3692-1-0x000000000041E380-mapping.dmp
-
memory/3812-4-0x0000000001080000-0x0000000001086000-memory.dmpFilesize
24KB
-
memory/3812-10-0x0000000006CE0000-0x0000000006DAF000-memory.dmpFilesize
828KB
-
memory/3812-3-0x0000000001080000-0x0000000001086000-memory.dmpFilesize
24KB
-
memory/3812-2-0x0000000000000000-mapping.dmp
-
memory/3944-8-0x0000000000000000-mapping.dmp