Analysis
-
max time kernel
50s -
max time network
67s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-12-2020 11:13
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVICE.exe
Resource
win7v20201028
General
-
Target
PAYMENT ADVICE.exe
-
Size
485KB
-
MD5
7b3a0c8d0b05933156402de9a42490fc
-
SHA1
49ea0ae6f2740dbbb7231423c16f8e88566bdb92
-
SHA256
ba0b2518a0073173f4940923af6e235eb8c392283903053d55e5dd31236a3b3d
-
SHA512
49e37363637fb91c2a8325c0a6f734f194d38a3aecdbf9f271a7dc2d22241a287467f7ad672a81e8b6fe6c5a642c45c3ceba05f762b18c7f5525f6c9c8988164
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PAYMENT ADVICE.exedescription pid process target process PID 640 set thread context of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PAYMENT ADVICE.exepid process 640 PAYMENT ADVICE.exe 640 PAYMENT ADVICE.exe 640 PAYMENT ADVICE.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
PAYMENT ADVICE.exePAYMENT ADVICE.exedescription pid process Token: SeDebugPrivilege 640 PAYMENT ADVICE.exe Token: SeImpersonatePrivilege 632 PAYMENT ADVICE.exe Token: SeTcbPrivilege 632 PAYMENT ADVICE.exe Token: SeChangeNotifyPrivilege 632 PAYMENT ADVICE.exe Token: SeCreateTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeBackupPrivilege 632 PAYMENT ADVICE.exe Token: SeRestorePrivilege 632 PAYMENT ADVICE.exe Token: SeIncreaseQuotaPrivilege 632 PAYMENT ADVICE.exe Token: SeAssignPrimaryTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeImpersonatePrivilege 632 PAYMENT ADVICE.exe Token: SeTcbPrivilege 632 PAYMENT ADVICE.exe Token: SeChangeNotifyPrivilege 632 PAYMENT ADVICE.exe Token: SeCreateTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeBackupPrivilege 632 PAYMENT ADVICE.exe Token: SeRestorePrivilege 632 PAYMENT ADVICE.exe Token: SeIncreaseQuotaPrivilege 632 PAYMENT ADVICE.exe Token: SeAssignPrimaryTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeImpersonatePrivilege 632 PAYMENT ADVICE.exe Token: SeTcbPrivilege 632 PAYMENT ADVICE.exe Token: SeChangeNotifyPrivilege 632 PAYMENT ADVICE.exe Token: SeCreateTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeBackupPrivilege 632 PAYMENT ADVICE.exe Token: SeRestorePrivilege 632 PAYMENT ADVICE.exe Token: SeIncreaseQuotaPrivilege 632 PAYMENT ADVICE.exe Token: SeAssignPrimaryTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeImpersonatePrivilege 632 PAYMENT ADVICE.exe Token: SeTcbPrivilege 632 PAYMENT ADVICE.exe Token: SeChangeNotifyPrivilege 632 PAYMENT ADVICE.exe Token: SeCreateTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeBackupPrivilege 632 PAYMENT ADVICE.exe Token: SeRestorePrivilege 632 PAYMENT ADVICE.exe Token: SeIncreaseQuotaPrivilege 632 PAYMENT ADVICE.exe Token: SeAssignPrimaryTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeImpersonatePrivilege 632 PAYMENT ADVICE.exe Token: SeTcbPrivilege 632 PAYMENT ADVICE.exe Token: SeChangeNotifyPrivilege 632 PAYMENT ADVICE.exe Token: SeCreateTokenPrivilege 632 PAYMENT ADVICE.exe Token: SeBackupPrivilege 632 PAYMENT ADVICE.exe Token: SeRestorePrivilege 632 PAYMENT ADVICE.exe Token: SeIncreaseQuotaPrivilege 632 PAYMENT ADVICE.exe Token: SeAssignPrimaryTokenPrivilege 632 PAYMENT ADVICE.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PAYMENT ADVICE.exePAYMENT ADVICE.exedescription pid process target process PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 640 wrote to memory of 632 640 PAYMENT ADVICE.exe PAYMENT ADVICE.exe PID 632 wrote to memory of 2304 632 PAYMENT ADVICE.exe cmd.exe PID 632 wrote to memory of 2304 632 PAYMENT ADVICE.exe cmd.exe PID 632 wrote to memory of 2304 632 PAYMENT ADVICE.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259342546.bat" "C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\259342546.batMD5
3880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
memory/632-14-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/632-16-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/632-15-0x0000000000410621-mapping.dmp
-
memory/640-10-0x000000000A5C0000-0x000000000A5C1000-memory.dmpFilesize
4KB
-
memory/640-9-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/640-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/640-11-0x00000000055F0000-0x00000000055FE000-memory.dmpFilesize
56KB
-
memory/640-12-0x0000000005E70000-0x0000000005EC1000-memory.dmpFilesize
324KB
-
memory/640-13-0x0000000008C30000-0x0000000008C31000-memory.dmpFilesize
4KB
-
memory/640-7-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/640-6-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/640-5-0x0000000004D90000-0x0000000004DDD000-memory.dmpFilesize
308KB
-
memory/640-3-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/2304-17-0x0000000000000000-mapping.dmp