fa769a960a22d4ce289da152e5535fa6f9e610d8796aeb907bacf3157c1270b5

General

Target

Statement of Account.exe
Size

808KB
MD5

8d7144cdca415dbdf39548d460a8866b
SHA1

7a37f9f0728708811235437d69fb74579548f758
SHA256

fa769a960a22d4ce289da152e5535fa6f9e610d8796aeb907bacf3157c1270b5
SHA512

955ae6fcd4bd5f77a5ea376fbbf7827315baf73bdfcefb5f519944398dcb700ea9f22218176624d89f0fd523ff34dccccad4139e1c8e6142d1f295e0f67498f0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

Statement of Account.exe

description pid process target process

PID 1916 set thread context of 768 1916 Statement of Account.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1088 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Statement of Account.exeMSBuild.exe

pid process

1916 Statement of Account.exe
768 MSBuild.exe
768 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Statement of Account.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1916 Statement of Account.exe
Token: SeDebugPrivilege 768 MSBuild.exe

description	pid	process	target process
PID 1916 set thread context of 768	1916	Statement of Account.exe	MSBuild.exe

pid	process
1088	schtasks.exe

pid	process
1916	Statement of Account.exe
768	MSBuild.exe
768	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1916	Statement of Account.exe
Token: SeDebugPrivilege	768	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Statement of Account.exe

description	pid	process	target process
PID 1916 wrote to memory of 1088	1916	Statement of Account.exe	schtasks.exe
PID 1916 wrote to memory of 1088	1916	Statement of Account.exe	schtasks.exe
PID 1916 wrote to memory of 1088	1916	Statement of Account.exe	schtasks.exe
PID 1916 wrote to memory of 1088	1916	Statement of Account.exe	schtasks.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe
PID 1916 wrote to memory of 768	1916	Statement of Account.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe
"C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eRwRffX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD652.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD652.tmp

MD5
2568f9ab62806f66efbbf62972696954

SHA1
f91755ad089196484d7f832019e8bc530457a59f

SHA256
ecac5383d127a91c0f9c5893e6bf70c47978617ad6315ff51f8a8161775eb86d

SHA512
94fe7d8e5f62bc68727659fe5c37e0933f529dad8107cbfd58b981877c4c71378d46e329457d30de1bbba4321cd0b7d1f70489002b9dfcd8e7ac00a9824f318b

Download Submit
memory/768-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-10-0x000000000043760E-mapping.dmp

Download
memory/768-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-13-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/1088-7-0x0000000000000000-mapping.dmp

Download
memory/1916-2-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/1916-3-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1916-5-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/1916-6-0x00000000049C0000-0x0000000004A33000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads