Analysis
- max time kernel
143s - max time network
25s - platform
windows7_x64 - resource
win7v200430 - submitted
20/07/2020, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
ORIGINAL BILL OF LADDING_PDF.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target ORIGINAL BILL OF LADDING_PDF.exe
- Size 687KB
- Sample200720-12sf3e4g8a
- SHA256 311d544af2d68a7cc2b4b72fc0daf60b888f060fe185eb1f6771b498d025cf16
- MD5 8834c2e853ca17ff0e5bac717c3db46a
- SHA1 0fa43517145a230ede87a7f87175c110fa0bb77c
- SHA512 805b803d7036e6d7720cb136137d1c8d031c80ba48ae6d228452b14154c63da72b2b0fa08cfb0a917d98273b700cd1a4d7758637b194a9f2928248a5d1b3bf76
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 240 set thread context of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 1816 ORIGINAL BILL OF LADDING_PDF.exe - Deletes itself 1 IoCs
pid Process 916 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 240 wrote to memory of 1816 240 ORIGINAL BILL OF LADDING_PDF.exe 26 PID 1816 wrote to memory of 916 1816 ORIGINAL BILL OF LADDING_PDF.exe 28 PID 1816 wrote to memory of 916 1816 ORIGINAL BILL OF LADDING_PDF.exe 28 PID 1816 wrote to memory of 916 1816 ORIGINAL BILL OF LADDING_PDF.exe 28 PID 1816 wrote to memory of 916 1816 ORIGINAL BILL OF LADDING_PDF.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\156141.bat" "C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe" "3⤵
- Deletes itself
PID:916
-
-