Analysis
- max time kernel
100s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:19
General
- Target Final_Invoices_For_Payment_Fairmont_Shipping_pdf.exe
- Size 276KB
- Sample201109-6r51ldt8ea
- SHA256 0f455b48c43367bf28076037a2d441e78f81143ea5067f144e7d5c6abb79dc73
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Final_Invoices_For_Payment_Fairmont_Shipping_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Final_Invoices_For_Payment_Fairmont_Shipping_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Final_Invoices_For_Payment_Fairmont_Shipping_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Final_Invoices_For_Payment_Fairmont_Shipping_pdf.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/980-9-0x0000000005660000-0x0000000005661000-memory.dmp
memory/980-1-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/980-4-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/980-5-0x00000000053E0000-0x00000000053E2000-memory.dmp
memory/980-6-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/980-7-0x00000000055F0000-0x00000000055F2000-memory.dmp
memory/980-8-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/980-0-0x0000000073310000-0x00000000739FE000-memory.dmp
memory/980-3-0x0000000002DE0000-0x0000000002DEF000-memory.dmp
memory/3932-10-0x0000000000400000-0x000000000041C000-memory.dmp
memory/3932-13-0x0000000073310000-0x00000000739FE000-memory.dmp
memory/3932-16-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/3932-19-0x0000000005190000-0x0000000005191000-memory.dmp
memory/3932-20-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/3932-21-0x0000000008EF0000-0x0000000008EF1000-memory.dmp
memory/3932-22-0x00000000091D0000-0x00000000091D1000-memory.dmp