Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10_x64 -
resource
win10 -
submitted
15-07-2020 13:44
Static task
static1
Behavioral task
behavioral1
Sample
MT103 PAYMENT COPY_PDF.exe
Resource
win7
Behavioral task
behavioral2
Sample
MT103 PAYMENT COPY_PDF.exe
Resource
win10
General
-
Target
MT103 PAYMENT COPY_PDF.exe
-
Size
369KB
-
MD5
20a2543a7a37a75b93924dd83c03743d
-
SHA1
dacf53a9ae5c29a1d33fb2bf064ede984a0ad379
-
SHA256
8c55df1fdc1ac49e2c0a3b5b77bd044d842d2f6e38bd5f782d93853a560140fb
-
SHA512
3c49d4b09b5510e9a2ea24e75c9bf694a006cd31b9d06546aa08ac369cb8464916c40c7d0db566ef82d4b147e265582f5d081c26f3b6ad9e99f6c792c9be0d10
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeraserver.exepid process 4016 MT103 PAYMENT COPY_PDF.exe 4016 MT103 PAYMENT COPY_PDF.exe 4016 MT103 PAYMENT COPY_PDF.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
raserver.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer raserver.exe -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Executes dropped EXE 1 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exepid process 4016 MT103 PAYMENT COPY_PDF.exe -
Drops file in Program Files directory 1 IoCs
Processes:
raserver.exedescription ioc process File opened for modification C:\Program Files (x86)\Zwbu\-zfmxtpqlux.exe raserver.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
raserver.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZNCDKZIXI = "C:\\Program Files (x86)\\Zwbu\\-zfmxtpqlux.exe" raserver.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3544 MT103 PAYMENT COPY_PDF.exe Token: SeDebugPrivilege 4016 MT103 PAYMENT COPY_PDF.exe Token: SeDebugPrivilege 3812 raserver.exe Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 69 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.exeraserver.exepid process 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 3544 MT103 PAYMENT COPY_PDF.exe 4016 MT103 PAYMENT COPY_PDF.exe 4016 MT103 PAYMENT COPY_PDF.exe 4016 MT103 PAYMENT COPY_PDF.exe 4016 MT103 PAYMENT COPY_PDF.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe 3812 raserver.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeExplorer.EXEraserver.exedescription pid process target process PID 3544 wrote to memory of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 3544 wrote to memory of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 3544 wrote to memory of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 3544 wrote to memory of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 3544 wrote to memory of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 3544 wrote to memory of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 2972 wrote to memory of 3812 2972 Explorer.EXE raserver.exe PID 2972 wrote to memory of 3812 2972 Explorer.EXE raserver.exe PID 2972 wrote to memory of 3812 2972 Explorer.EXE raserver.exe PID 3812 wrote to memory of 3796 3812 raserver.exe cmd.exe PID 3812 wrote to memory of 3796 3812 raserver.exe cmd.exe PID 3812 wrote to memory of 3796 3812 raserver.exe cmd.exe PID 3812 wrote to memory of 3704 3812 raserver.exe cmd.exe PID 3812 wrote to memory of 3704 3812 raserver.exe cmd.exe PID 3812 wrote to memory of 3704 3812 raserver.exe cmd.exe PID 3812 wrote to memory of 1028 3812 raserver.exe Firefox.exe PID 3812 wrote to memory of 1028 3812 raserver.exe Firefox.exe PID 3812 wrote to memory of 1028 3812 raserver.exe Firefox.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MT103 PAYMENT COPY_PDF.exeMT103 PAYMENT COPY_PDF.exeraserver.exedescription pid process target process PID 3544 set thread context of 4016 3544 MT103 PAYMENT COPY_PDF.exe MT103 PAYMENT COPY_PDF.exe PID 4016 set thread context of 2972 4016 MT103 PAYMENT COPY_PDF.exe Explorer.EXE PID 3812 set thread context of 2972 3812 raserver.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious behavior: MapViewOfSection
- System policy modification
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Adds policy Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1
-
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logim.jpeg
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrf.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrg.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logri.ini
-
C:\Users\Admin\AppData\Roaming\4L946DRT\4L9logrv.ini
-
memory/1028-13-0x00007FF73E940000-0x00007FF73E9D3000-memory.dmpFilesize
588KB
-
memory/1028-14-0x00007FF73E940000-0x00007FF73E9D3000-memory.dmpFilesize
588KB
-
memory/1028-11-0x0000000000000000-mapping.dmp
-
memory/1028-12-0x00007FF73E940000-0x00007FF73E9D3000-memory.dmpFilesize
588KB
-
memory/3704-8-0x0000000000000000-mapping.dmp
-
memory/3796-6-0x0000000000000000-mapping.dmp
-
memory/3812-5-0x0000000000120000-0x000000000013F000-memory.dmpFilesize
124KB
-
memory/3812-10-0x00000000030D0000-0x000000000317D000-memory.dmpFilesize
692KB
-
memory/3812-7-0x0000000005680000-0x00000000057D7000-memory.dmpFilesize
1.3MB
-
memory/3812-4-0x0000000000120000-0x000000000013F000-memory.dmpFilesize
124KB
-
memory/3812-3-0x0000000000000000-mapping.dmp
-
memory/4016-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4016-1-0x000000000041E2D0-mapping.dmp