Analysis
- max time kernel
5s - max time network
40s - platform
windows10_x64 - resource
win10 - submitted
28/07/2020, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
New_Bank_Information.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target New_Bank_Information.exe
- Size 768KB
- Sample200728-aaf5wse2b6
- SHA256 707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058
- MD5 fb6d84ef009530fe590ff062bb674c6f
- SHA1 9d4ac7c3db2d51fe71aa2249e228f5f5a4d54d4a
- SHA512 acbb34c0122cb2e23443d344543f6d197bfd3399bc7a86cd78289b822f315fc2b001268fe71a8731e70ad1909fe9244c0731a525281180c80fab9c2334acb2ea
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2972 svchost.exe 1968 svchost.exe 2080 svchost.exe -
resource yara_rule behavioral2/memory/4036-1-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral2/memory/4036-4-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral2/memory/4036-5-0x0000000000400000-0x00000000004D0000-memory.dmp upx - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs notepad.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SubDir\svchost.exe New_Bank_Information.exe File opened for modification C:\Windows\SysWOW64\SubDir\svchost.exe New_Bank_Information.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2460 set thread context of 4036 2460 New_Bank_Information.exe 68 PID 2972 set thread context of 1968 2972 svchost.exe 75 PID 3608 set thread context of 3880 3608 New_Bank_Information.exe 79 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3376 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2460 New_Bank_Information.exe 2460 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe 3172 New_Bank_Information.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2460 New_Bank_Information.exe 2972 svchost.exe 3608 New_Bank_Information.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4036 New_Bank_Information.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3948 2460 New_Bank_Information.exe 67 PID 2460 wrote to memory of 3948 2460 New_Bank_Information.exe 67 PID 2460 wrote to memory of 3948 2460 New_Bank_Information.exe 67 PID 2460 wrote to memory of 3948 2460 New_Bank_Information.exe 67 PID 2460 wrote to memory of 3948 2460 New_Bank_Information.exe 67 PID 2460 wrote to memory of 4036 2460 New_Bank_Information.exe 68 PID 2460 wrote to memory of 4036 2460 New_Bank_Information.exe 68 PID 2460 wrote to memory of 4036 2460 New_Bank_Information.exe 68 PID 2460 wrote to memory of 3172 2460 New_Bank_Information.exe 69 PID 2460 wrote to memory of 3172 2460 New_Bank_Information.exe 69 PID 2460 wrote to memory of 3172 2460 New_Bank_Information.exe 69 PID 4036 wrote to memory of 3376 4036 New_Bank_Information.exe 71 PID 4036 wrote to memory of 3376 4036 New_Bank_Information.exe 71 PID 4036 wrote to memory of 3376 4036 New_Bank_Information.exe 71 PID 4036 wrote to memory of 2972 4036 New_Bank_Information.exe 73 PID 4036 wrote to memory of 2972 4036 New_Bank_Information.exe 73 PID 4036 wrote to memory of 2972 4036 New_Bank_Information.exe 73 PID 2972 wrote to memory of 3980 2972 svchost.exe 74 PID 2972 wrote to memory of 3980 2972 svchost.exe 74 PID 2972 wrote to memory of 3980 2972 svchost.exe 74 PID 2972 wrote to memory of 3980 2972 svchost.exe 74 PID 2972 wrote to memory of 3980 2972 svchost.exe 74 PID 2972 wrote to memory of 1968 2972 svchost.exe 75 PID 2972 wrote to memory of 1968 2972 svchost.exe 75 PID 2972 wrote to memory of 1968 2972 svchost.exe 75 PID 2972 wrote to memory of 2080 2972 svchost.exe 76 PID 2972 wrote to memory of 2080 2972 svchost.exe 76 PID 2972 wrote to memory of 2080 2972 svchost.exe 76 PID 3172 wrote to memory of 3608 3172 New_Bank_Information.exe 77 PID 3172 wrote to memory of 3608 3172 New_Bank_Information.exe 77 PID 3172 wrote to memory of 3608 3172 New_Bank_Information.exe 77 PID 3608 wrote to memory of 2116 3608 New_Bank_Information.exe 78 PID 3608 wrote to memory of 2116 3608 New_Bank_Information.exe 78 PID 3608 wrote to memory of 2116 3608 New_Bank_Information.exe 78 PID 3608 wrote to memory of 2116 3608 New_Bank_Information.exe 78 PID 3608 wrote to memory of 2116 3608 New_Bank_Information.exe 78 PID 3608 wrote to memory of 3880 3608 New_Bank_Information.exe 79 PID 3608 wrote to memory of 3880 3608 New_Bank_Information.exe 79 PID 3608 wrote to memory of 3880 3608 New_Bank_Information.exe 79 PID 3608 wrote to memory of 732 3608 New_Bank_Information.exe 80 PID 3608 wrote to memory of 732 3608 New_Bank_Information.exe 80 PID 3608 wrote to memory of 732 3608 New_Bank_Information.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3376
-
-
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
- Drops startup file
PID:3980
-
-
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"4⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe" 2 1968 624374⤵
- Executes dropped EXE
PID:2080
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 4036 587032⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
- Drops startup file
PID:2116
-
-
C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"4⤵PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 3880 628754⤵PID:732
-
-
-