Analysis
- max time kernel
117s - max time network
120s - platform
windows10_x64 - resource
win10 - submitted
20/07/2020, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
ORIGINAL BILL OF LADDING_PDF.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target ORIGINAL BILL OF LADDING_PDF.exe
- Size 687KB
- Sample200720-12sf3e4g8a
- SHA256 311d544af2d68a7cc2b4b72fc0daf60b888f060fe185eb1f6771b498d025cf16
- MD5 8834c2e853ca17ff0e5bac717c3db46a
- SHA1 0fa43517145a230ede87a7f87175c110fa0bb77c
- SHA512 805b803d7036e6d7720cb136137d1c8d031c80ba48ae6d228452b14154c63da72b2b0fa08cfb0a917d98273b700cd1a4d7758637b194a9f2928248a5d1b3bf76
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4092 ORIGINAL BILL OF LADDING_PDF.exe 4092 ORIGINAL BILL OF LADDING_PDF.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4092 set thread context of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4092 wrote to memory of 3832 4092 ORIGINAL BILL OF LADDING_PDF.exe 67 PID 4092 wrote to memory of 3832 4092 ORIGINAL BILL OF LADDING_PDF.exe 67 PID 4092 wrote to memory of 3832 4092 ORIGINAL BILL OF LADDING_PDF.exe 67 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 4092 wrote to memory of 3368 4092 ORIGINAL BILL OF LADDING_PDF.exe 68 PID 3368 wrote to memory of 3516 3368 ORIGINAL BILL OF LADDING_PDF.exe 69 PID 3368 wrote to memory of 3516 3368 ORIGINAL BILL OF LADDING_PDF.exe 69 PID 3368 wrote to memory of 3516 3368 ORIGINAL BILL OF LADDING_PDF.exe 69 - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 4092 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeImpersonatePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeTcbPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeChangeNotifyPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeCreateTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeBackupPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeRestorePrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeIncreaseQuotaPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe Token: SeAssignPrimaryTokenPrivilege 3368 ORIGINAL BILL OF LADDING_PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"{path}"2⤵PID:3832
-
-
C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\109562.bat" "C:\Users\Admin\AppData\Local\Temp\ORIGINAL BILL OF LADDING_PDF.exe" "3⤵PID:3516
-
-