Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10_x64 -
resource
win10 -
submitted
15-07-2020 13:44
Static task
static1
Behavioral task
behavioral1
Sample
MT103 PAYMENT COPY_PDF.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MT103 PAYMENT COPY_PDF.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
MT103 PAYMENT COPY_PDF.exe
-
Size
369KB
-
MD5
20a2543a7a37a75b93924dd83c03743d
-
SHA1
dacf53a9ae5c29a1d33fb2bf064ede984a0ad379
-
SHA256
8c55df1fdc1ac49e2c0a3b5b77bd044d842d2f6e38bd5f782d93853a560140fb
-
SHA512
3c49d4b09b5510e9a2ea24e75c9bf694a006cd31b9d06546aa08ac369cb8464916c40c7d0db566ef82d4b147e265582f5d081c26f3b6ad9e99f6c792c9be0d10
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3180 MT103 PAYMENT COPY_PDF.exe Token: SeDebugPrivilege 3860 MT103 PAYMENT COPY_PDF.exe Token: SeDebugPrivilege 3948 mstsc.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3180 wrote to memory of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3180 wrote to memory of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3180 wrote to memory of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3180 wrote to memory of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3180 wrote to memory of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3180 wrote to memory of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3020 wrote to memory of 3948 3020 Explorer.EXE 68 PID 3020 wrote to memory of 3948 3020 Explorer.EXE 68 PID 3020 wrote to memory of 3948 3020 Explorer.EXE 68 PID 3948 wrote to memory of 3012 3948 mstsc.exe 69 PID 3948 wrote to memory of 3012 3948 mstsc.exe 69 PID 3948 wrote to memory of 3012 3948 mstsc.exe 69 PID 3948 wrote to memory of 1888 3948 mstsc.exe 77 PID 3948 wrote to memory of 1888 3948 mstsc.exe 77 PID 3948 wrote to memory of 1888 3948 mstsc.exe 77 PID 3948 wrote to memory of 2172 3948 mstsc.exe 79 PID 3948 wrote to memory of 2172 3948 mstsc.exe 79 PID 3948 wrote to memory of 2172 3948 mstsc.exe 79 -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3180 set thread context of 3860 3180 MT103 PAYMENT COPY_PDF.exe 67 PID 3860 set thread context of 3020 3860 MT103 PAYMENT COPY_PDF.exe 56 PID 3948 set thread context of 3020 3948 mstsc.exe 56 -
Executes dropped EXE 1 IoCs
pid Process 3860 MT103 PAYMENT COPY_PDF.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Acjox\servicesspjh3b.exe mstsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XPIXIXE0 = "C:\\Program Files (x86)\\Acjox\\servicesspjh3b.exe" mstsc.exe -
Suspicious behavior: EnumeratesProcesses 69 IoCs
pid Process 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3180 MT103 PAYMENT COPY_PDF.exe 3860 MT103 PAYMENT COPY_PDF.exe 3860 MT103 PAYMENT COPY_PDF.exe 3860 MT103 PAYMENT COPY_PDF.exe 3860 MT103 PAYMENT COPY_PDF.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3860 MT103 PAYMENT COPY_PDF.exe 3860 MT103 PAYMENT COPY_PDF.exe 3860 MT103 PAYMENT COPY_PDF.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe 3948 mstsc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3860
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Drops file in Program Files directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3948 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MT103 PAYMENT COPY_PDF.exe"3⤵PID:3012
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1888
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2172
-
-