fa769a960a22d4ce289da152e5535fa6f9e610d8796aeb907bacf3157c1270b5

General

Target

Statement of Account.exe
Size

808KB
MD5

8d7144cdca415dbdf39548d460a8866b
SHA1

7a37f9f0728708811235437d69fb74579548f758
SHA256

fa769a960a22d4ce289da152e5535fa6f9e610d8796aeb907bacf3157c1270b5
SHA512

955ae6fcd4bd5f77a5ea376fbbf7827315baf73bdfcefb5f519944398dcb700ea9f22218176624d89f0fd523ff34dccccad4139e1c8e6142d1f295e0f67498f0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

Statement of Account.exe

description pid process target process

PID 504 set thread context of 3200 504 Statement of Account.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2044 schtasks.exe

description	pid	process	target process
PID 504 set thread context of 3200	504	Statement of Account.exe	MSBuild.exe

pid	process
2044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

Statement of Account.exeMSBuild.exe

pid	process
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
504	Statement of Account.exe
3200	MSBuild.exe
3200	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Statement of Account.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 504 Statement of Account.exe
Token: SeDebugPrivilege 3200 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	504	Statement of Account.exe
Token: SeDebugPrivilege	3200	MSBuild.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Statement of Account.exe

description	pid	process	target process
PID 504 wrote to memory of 2044	504	Statement of Account.exe	schtasks.exe
PID 504 wrote to memory of 2044	504	Statement of Account.exe	schtasks.exe
PID 504 wrote to memory of 2044	504	Statement of Account.exe	schtasks.exe
PID 504 wrote to memory of 3016	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3016	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3016	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 744	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 744	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 744	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3052	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3052	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3052	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 1332	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 1332	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 1332	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe
PID 504 wrote to memory of 3200	504	Statement of Account.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe
"C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:504

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eRwRffX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B30.tmp"
2⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:3052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5B30.tmp
MD5
066c5280a69ad6ab833cbe2955fa457c

SHA1
37fc6e76ae917bb02b0eeec7375b3cc391d6464e

SHA256
7cff9a641cf669349ab617558ef825865791c53fce09612752f1702442367206

SHA512
fef590164caffa8554d1321c6fe3bb56492b84628e1418fde0f0479af021bd6ee72315ec5b630ce1e92715b0c9b7d29c8147f90880c5b656e509c3521a358220

Download Submit
memory/504-6-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/504-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/504-2-0x0000000073D40000-0x000000007442E000-memory.dmp

Filesize
6.9MB

Download
memory/504-7-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/504-8-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/504-9-0x00000000031F0000-0x0000000003202000-memory.dmp

Filesize
72KB

Download
memory/504-10-0x0000000001680000-0x00000000016F3000-memory.dmp

Filesize
460KB

Download
memory/504-5-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

Filesize
4KB

Download
memory/2044-11-0x0000000000000000-mapping.dmp

Download
memory/3200-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3200-14-0x000000000043760E-mapping.dmp

Download
memory/3200-15-0x0000000073D40000-0x000000007442E000-memory.dmp

Filesize
6.9MB

Download
memory/3200-20-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/3200-21-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads