Analysis
- max time kernel
51s - max time network
13s - platform
windows7_x64 - resource
win7v200722 - submitted
23/10/2020, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
Bank Swift TT copy.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Bank Swift TT copy.exe
- Size 882KB
- Sample201023-e4ln8bjzh6
- SHA256 51fc4c13e2fa607113d821aaab2ba2e96d10097d69698ec3facc71b8b751e068
- MD5 750573c0d279954b21170cd2e060002e
- SHA1 b2b914956935da87e68847688476e4dbcdd9f3ce
- SHA512 90e5ae4fda9520bbd145cd9a712c04a0b0d376825ab6a3bd8873b088dd4ce05aad4bfa3d19aa38a2300631d72c7b9a44766a063302be3635ae08288271aa0ce3
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 336 Bank Swift TT copy.exe 336 Bank Swift TT copy.exe 336 Bank Swift TT copy.exe 336 Bank Swift TT copy.exe 336 Bank Swift TT copy.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 336 Bank Swift TT copy.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 336 wrote to memory of 1616 336 Bank Swift TT copy.exe 28 PID 336 wrote to memory of 1616 336 Bank Swift TT copy.exe 28 PID 336 wrote to memory of 1616 336 Bank Swift TT copy.exe 28 PID 336 wrote to memory of 1616 336 Bank Swift TT copy.exe 28 PID 336 wrote to memory of 1696 336 Bank Swift TT copy.exe 29 PID 336 wrote to memory of 1696 336 Bank Swift TT copy.exe 29 PID 336 wrote to memory of 1696 336 Bank Swift TT copy.exe 29 PID 336 wrote to memory of 1696 336 Bank Swift TT copy.exe 29 PID 336 wrote to memory of 1624 336 Bank Swift TT copy.exe 30 PID 336 wrote to memory of 1624 336 Bank Swift TT copy.exe 30 PID 336 wrote to memory of 1624 336 Bank Swift TT copy.exe 30 PID 336 wrote to memory of 1624 336 Bank Swift TT copy.exe 30 PID 336 wrote to memory of 1588 336 Bank Swift TT copy.exe 31 PID 336 wrote to memory of 1588 336 Bank Swift TT copy.exe 31 PID 336 wrote to memory of 1588 336 Bank Swift TT copy.exe 31 PID 336 wrote to memory of 1588 336 Bank Swift TT copy.exe 31 PID 336 wrote to memory of 1560 336 Bank Swift TT copy.exe 32 PID 336 wrote to memory of 1560 336 Bank Swift TT copy.exe 32 PID 336 wrote to memory of 1560 336 Bank Swift TT copy.exe 32 PID 336 wrote to memory of 1560 336 Bank Swift TT copy.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"{path}"2⤵PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"{path}"2⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"{path}"2⤵PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"{path}"2⤵PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift TT copy.exe"{path}"2⤵PID:1560
-