Analysis
- max time kernel
64s - max time network
121s - platform
windows7_x64 - resource
win7v200722 - submitted
05/10/2020, 11:48
General
- Target PAYMENT10043210022211-pdf.exe
- Size 831KB
- Sample201005-vflrwacpke
- SHA256 f8f5e97b40ead4c316e0dc6adc5490aafdf806ec5c203931e9d699be3b95a88a
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT10043210022211-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT10043210022211-pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1436-1-0x0000000001120000-0x0000000001121000-memory.dmp
memory/1436-3-0x0000000000410000-0x0000000000435000-memory.dmp
memory/1436-5-0x0000000000610000-0x0000000000616000-memory.dmp
memory/1436-0-0x0000000074820000-0x0000000074F0E000-memory.dmp
memory/1568-7-0x0000000000400000-0x0000000000486000-memory.dmp
memory/1568-11-0x0000000000400000-0x0000000000486000-memory.dmp
memory/1568-10-0x0000000000400000-0x0000000000486000-memory.dmp
memory/1568-14-0x0000000073BA0000-0x000000007428E000-memory.dmp