df91e3d8c094bb91bbc717a36ff7d42302b5f362aedde2333fac71cd42010a28

Analysis

max time kernel
132s
max time network
137s
platform
windows7_x64
resource
win7
submitted
18/10/2020, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order_payment.exe
Size 913KB
Sample201018-etjdeawdhs
SHA256 df91e3d8c094bb91bbc717a36ff7d42302b5f362aedde2333fac71cd42010a28
MD5 9e3cbb3ba41861f9e261aa04634bfece
SHA1 0feb18d18ffbef73cb2cd83e4407cfabf0c1758e
SHA512 6f3c3ce728f4cccabcdf4440f0060363a12a00003ee553327bbb6a1cdf01a5e1f7a4dabcbb7d1164ff21ecafb34639b60e2681209c096d897f7327a7dbf16b23
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
272	server.exe
636	server.exe
940	server.exe
992	server.exe
1488	server.exe
1596	server.exe

Loads dropped DLL 6 IoCs

pid	Process
2020	order_payment.exe
272	server.exe
272	server.exe
272	server.exe
272	server.exe
272	server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 2020	1152	order_payment.exe	28

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1152	order_payment.exe
1152	order_payment.exe
2020	order_payment.exe
272	server.exe
272	server.exe
272	server.exe
272	server.exe
272	server.exe
272	server.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	order_payment.exe
Token: SeDebugPrivilege	2020	order_payment.exe
Token: SeDebugPrivilege	272	server.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 1152 wrote to memory of 2020	1152	order_payment.exe	28
PID 2020 wrote to memory of 272	2020	order_payment.exe	29
PID 2020 wrote to memory of 272	2020	order_payment.exe	29
PID 2020 wrote to memory of 272	2020	order_payment.exe	29
PID 2020 wrote to memory of 272	2020	order_payment.exe	29
PID 272 wrote to memory of 636	272	server.exe	30
PID 272 wrote to memory of 636	272	server.exe	30
PID 272 wrote to memory of 636	272	server.exe	30
PID 272 wrote to memory of 636	272	server.exe	30
PID 272 wrote to memory of 940	272	server.exe	31
PID 272 wrote to memory of 940	272	server.exe	31
PID 272 wrote to memory of 940	272	server.exe	31
PID 272 wrote to memory of 940	272	server.exe	31
PID 272 wrote to memory of 992	272	server.exe	32
PID 272 wrote to memory of 992	272	server.exe	32
PID 272 wrote to memory of 992	272	server.exe	32
PID 272 wrote to memory of 992	272	server.exe	32
PID 272 wrote to memory of 1488	272	server.exe	33
PID 272 wrote to memory of 1488	272	server.exe	33
PID 272 wrote to memory of 1488	272	server.exe	33
PID 272 wrote to memory of 1488	272	server.exe	33
PID 272 wrote to memory of 1596	272	server.exe	34
PID 272 wrote to memory of 1596	272	server.exe	34
PID 272 wrote to memory of 1596	272	server.exe	34
PID 272 wrote to memory of 1596	272	server.exe	34

C:\Users\Admin\AppData\Local\Temp\order_payment.exe
"C:\Users\Admin\AppData\Local\Temp\order_payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\order_payment.exe
  "C:\Users\Admin\AppData\Local\Temp\order_payment.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:272
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      PID:636
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-17-0x0000000072EA0000-0x000000007358E000-memory.dmp

Download

memory/272-18-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/1152-1-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/1152-0-0x0000000073B20000-0x000000007420E000-memory.dmp

Download

memory/1152-4-0x0000000004E60000-0x0000000004E9D000-memory.dmp

Download

memory/1152-3-0x00000000003D0000-0x00000000003DB000-memory.dmp

Download

memory/1152-5-0x0000000000550000-0x000000000055B000-memory.dmp

Download

memory/2020-9-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2020-10-0x0000000072EA0000-0x000000007358E000-memory.dmp

Download

memory/2020-8-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2020-6-0x0000000000400000-0x000000000040E000-memory.dmp

Download