Analysis
- max time kernel
150s - max time network
139s - platform
windows7_x64 - resource
win7 - submitted
05/08/2020, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
bank details.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bank details.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target bank details.exe
- Size 617KB
- Sample200805-khv848prla
- SHA256 684c2ac7c5d08c046fd4907cc4466827dc01fdd403ff7bbd64c5aa247884ac74
- MD5 4671b5ef3dd5821226fffa3a5d2fd1f2
- SHA1 6936fbc76e7655c732706ed95995ba90b38a8460
- SHA512 d29b23ddde4b6a9ff220b2592ff39a4bea2bd44570979e78dddf9e770e719eb58c7236a66bb19894b005878fc10a3ca01da61cf73b74e47d191084c08b41091a
- MD5 SHA1 SHA512
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8PKXHTYXYR = "C:\\Program Files (x86)\\Nzxqlxz\\systrayfpj8ixup.exe" cmd.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 280 schtasks.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 540 RegSvcs.exe 540 RegSvcs.exe 540 RegSvcs.exe 540 RegSvcs.exe 1048 cmd.exe 1048 cmd.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1088 set thread context of 540 1088 bank details.exe 26 PID 540 set thread context of 1276 540 RegSvcs.exe 20 PID 540 set thread context of 1276 540 RegSvcs.exe 20 PID 1048 set thread context of 1276 1048 cmd.exe 20 - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Nzxqlxz\systrayfpj8ixup.exe cmd.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1088 bank details.exe 1088 bank details.exe 1088 bank details.exe 540 RegSvcs.exe 540 RegSvcs.exe 540 RegSvcs.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe 1048 cmd.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1088 wrote to memory of 280 1088 bank details.exe 24 PID 1088 wrote to memory of 280 1088 bank details.exe 24 PID 1088 wrote to memory of 280 1088 bank details.exe 24 PID 1088 wrote to memory of 280 1088 bank details.exe 24 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1088 wrote to memory of 540 1088 bank details.exe 26 PID 1276 wrote to memory of 1048 1276 Explorer.EXE 27 PID 1276 wrote to memory of 1048 1276 Explorer.EXE 27 PID 1276 wrote to memory of 1048 1276 Explorer.EXE 27 PID 1276 wrote to memory of 1048 1276 Explorer.EXE 27 PID 1048 wrote to memory of 284 1048 cmd.exe 28 PID 1048 wrote to memory of 284 1048 cmd.exe 28 PID 1048 wrote to memory of 284 1048 cmd.exe 28 PID 1048 wrote to memory of 284 1048 cmd.exe 28 - Formbook Payload 4 IoCs
resource yara_rule behavioral1/memory/540-4-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/540-4-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/540-5-0x000000000041E310-mapping.dmp formbook behavioral1/memory/1048-7-0x0000000000000000-mapping.dmp formbook - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1088 bank details.exe Token: SeDebugPrivilege 540 RegSvcs.exe Token: SeShutdownPrivilege 1276 Explorer.EXE Token: SeDebugPrivilege 1048 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\bank details.exe"C:\Users\Admin\AppData\Local\Temp\bank details.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EhsvvVwepgW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA39E.tmp"3⤵
- Creates scheduled task(s)
PID:280
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:284
-
-