Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Receipt.exe
Resource
win7v20201028
General
-
Target
Shipment Receipt.exe
-
Size
645KB
-
MD5
ff18c255222072cfb586481fb1df38e8
-
SHA1
590ee95cd05e6df3c52c07c308ac081e28f03e1b
-
SHA256
fe719ecb5f04ed964bd5fdecc2085bdb1518358c65d12462fcddb66a6015740d
-
SHA512
46c53805c144cc1fef06626c5b1df821f966b9c8c51151676b1d105795059d4de573309da61c3e148a01affff47b4446fca81cab39062c8945273344ce736854
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipment Receipt.exedescription pid process target process PID 1100 set thread context of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 set thread context of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 set thread context of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Shipment Receipt.exeShipment Receipt.exepid process 3892 Shipment Receipt.exe 3892 Shipment Receipt.exe 2020 Shipment Receipt.exe 2020 Shipment Receipt.exe 3892 Shipment Receipt.exe 3892 Shipment Receipt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Shipment Receipt.exedescription pid process Token: SeDebugPrivilege 2020 Shipment Receipt.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Shipment Receipt.exepid process 1100 Shipment Receipt.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Shipment Receipt.execmd.exeShipment Receipt.exeShipment Receipt.exeShipment Receipt.exedescription pid process target process PID 756 wrote to memory of 2716 756 Shipment Receipt.exe cmd.exe PID 756 wrote to memory of 2716 756 Shipment Receipt.exe cmd.exe PID 756 wrote to memory of 2716 756 Shipment Receipt.exe cmd.exe PID 756 wrote to memory of 3432 756 Shipment Receipt.exe Shipment Receipt.exe PID 756 wrote to memory of 3432 756 Shipment Receipt.exe Shipment Receipt.exe PID 756 wrote to memory of 3432 756 Shipment Receipt.exe Shipment Receipt.exe PID 2716 wrote to memory of 3388 2716 cmd.exe schtasks.exe PID 2716 wrote to memory of 3388 2716 cmd.exe schtasks.exe PID 2716 wrote to memory of 3388 2716 cmd.exe schtasks.exe PID 3432 wrote to memory of 2348 3432 Shipment Receipt.exe Shipment Receipt.exe PID 3432 wrote to memory of 2348 3432 Shipment Receipt.exe Shipment Receipt.exe PID 3432 wrote to memory of 2348 3432 Shipment Receipt.exe Shipment Receipt.exe PID 2348 wrote to memory of 1100 2348 Shipment Receipt.exe Shipment Receipt.exe PID 2348 wrote to memory of 1100 2348 Shipment Receipt.exe Shipment Receipt.exe PID 2348 wrote to memory of 1100 2348 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 3892 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2020 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe PID 1100 wrote to memory of 2408 1100 Shipment Receipt.exe Shipment Receipt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN flies /XML "C:\Users\Admin\AppData\Local\Temp\580d4f859ac64ea0a20365f9ab526d67.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN flies /XML "C:\Users\Admin\AppData\Local\Temp\580d4f859ac64ea0a20365f9ab526d67.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fdmianydbzliwedf"5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ifrtbxqfphdngkzrnsk"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Receipt.exe" /stext "C:\Users\Admin\AppData\Local\Temp\szemcpbycpvajqnvwdfjjn"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\580d4f859ac64ea0a20365f9ab526d67.xmlMD5
b362d71396554606927de2efedfc5241
SHA1d3c90e9a7b8ab2ec0b7b9035e075484edd8d03ea
SHA256331bd5a3066a33606e45a9ba66d7f0dc616542192dd6142ef87ff10f1549fcd7
SHA512998b67e295973833cc48e0f74cd39e98aefbc2f2b9395be3085590703be2e79a265d0dec7019546a5349f58cfc6282bd579a6a780267eb5e678fec05c5dc8f05
-
C:\Users\Admin\AppData\Local\Temp\fdmianydbzliwedfMD5
1e69b6d630e694119f4f8c448a430b60
SHA1b118feca7d85ec706b54279a1dafc71673fe6e54
SHA2562f7eedbe9e3b0a3aa08df4fa2dc27de189484a8da8925cc6056513d744b7c00e
SHA51219924161f75cbbcf7bdf122f3aecb43d813186a6693413ccc15bb2945d48401c8f058edf034cc641cedc97ae5e328d88fabfab1b5f324014b83671b3ebd78822
-
memory/1100-7-0x0000000000000000-mapping.dmp
-
memory/2020-16-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2020-10-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2020-12-0x0000000000422206-mapping.dmp
-
memory/2020-13-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2348-6-0x0000000000000000-mapping.dmp
-
memory/2408-18-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2408-19-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2408-17-0x0000000000455238-mapping.dmp
-
memory/2408-15-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2716-2-0x0000000000000000-mapping.dmp
-
memory/3388-4-0x0000000000000000-mapping.dmp
-
memory/3432-3-0x0000000000000000-mapping.dmp
-
memory/3892-8-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3892-11-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3892-14-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3892-9-0x0000000000476274-mapping.dmp