Overview

overview

10

Static

static

invoice ag...nt.exe

windows7_x64

10

invoice ag...nt.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01-03-2021 17:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    invoice against the VAT Payment.exe

  • Size

    2.8MB

  • MD5

    f2483ffa1d7e980ef6a9e208a2297464

  • SHA1

    18e409e5f3e363e4032c17cbff75ec21d6b3d492

  • SHA256

    33e1b67ad4d3fa79b5962739474792e251306c7474e9a9e3afa0fc6d5e93b4b4

  • SHA512

    0702b1c67163e8ac359d65817796ff7f9622db23e79083662e5bc6e67eafd4c2dd2073e7bcb7599677a9ecc1d8295c095c0d18c4f2e99732fe2991f5eea1c136

Score
10/10
xenarmorpasswordpersistencerecoveryspywareupx

Malware Config

Signatures

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\invoice against the VAT Payment.exe
    "C:\Users\Admin\AppData\Local\Temp\invoice against the VAT Payment.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\AppData\Local\notepad\notepad.exe
      -a "C:\Users\Admin\AppData\Local\ea3cd9b6\plg\fNqQUMhH.json"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Opens file in notepad (likely ransom note)
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Users\Admin\AppData\Local\notepad\notepad.exe
        -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Opens file in notepad (likely ransom note)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\unk.xml
    MD5

    67efe59fbf8aaf3e8de7d67dab21c2a7

    SHA1

    0869d3ea3b16639ed4a0803acea1c476e199b16c

    SHA256

    63ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1

    SHA512

    75f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb

    Download Submit
  • C:\Users\Admin\AppData\Local\ea3cd9b6\plg\fNqQUMhH.json
    MD5

    67efe59fbf8aaf3e8de7d67dab21c2a7

    SHA1

    0869d3ea3b16639ed4a0803acea1c476e199b16c

    SHA256

    63ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1

    SHA512

    75f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb

    Download Submit
  • C:\Users\Admin\AppData\Local\notepad\License.XenArmor
    MD5

    4f3bde9212e17ef18226866d6ac739b6

    SHA1

    732733bec8314beb81437e60876ffa75e72ae6cd

    SHA256

    212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

    SHA512

    10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

    Download Submit
  • C:\Users\Admin\AppData\Local\notepad\License.XenArmor
    MD5

    bf5da170f7c9a8eae88d1cb1a191ff80

    SHA1

    dd1b991a1b03587a5d1edc94e919a2070e325610

    SHA256

    e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

    SHA512

    9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

    Download Submit
  • C:\Users\Admin\AppData\Local\notepad\Unknown.dll
    MD5

    86114faba7e1ec4a667d2bcb2e23f024

    SHA1

    670df6e1ba1dc6bece046e8b2e573dd36748245e

    SHA256

    568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

    SHA512

    d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

    Download Submit
  • C:\Users\Admin\AppData\Local\notepad\notepad.exe
    MD5

    f2483ffa1d7e980ef6a9e208a2297464

    SHA1

    18e409e5f3e363e4032c17cbff75ec21d6b3d492

    SHA256

    33e1b67ad4d3fa79b5962739474792e251306c7474e9a9e3afa0fc6d5e93b4b4

    SHA512

    0702b1c67163e8ac359d65817796ff7f9622db23e79083662e5bc6e67eafd4c2dd2073e7bcb7599677a9ecc1d8295c095c0d18c4f2e99732fe2991f5eea1c136

    Download Submit
  • C:\Users\Admin\AppData\Local\notepad\notepad.exe
    MD5

    f2483ffa1d7e980ef6a9e208a2297464

    SHA1

    18e409e5f3e363e4032c17cbff75ec21d6b3d492

    SHA256

    33e1b67ad4d3fa79b5962739474792e251306c7474e9a9e3afa0fc6d5e93b4b4

    SHA512

    0702b1c67163e8ac359d65817796ff7f9622db23e79083662e5bc6e67eafd4c2dd2073e7bcb7599677a9ecc1d8295c095c0d18c4f2e99732fe2991f5eea1c136

    Download Submit
  • \Users\Admin\AppData\Local\notepad\Unknown.dll
    MD5

    86114faba7e1ec4a667d2bcb2e23f024

    SHA1

    670df6e1ba1dc6bece046e8b2e573dd36748245e

    SHA256

    568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

    SHA512

    d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

    Download Submit
  • memory/664-18-0x000007FEF7510000-0x000007FEF778A000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1108-3-0x0000000002E80000-0x0000000002E91000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1108-4-0x0000000003080000-0x0000000003091000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1108-2-0x00000000760D1000-0x00000000760D3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1224-5-0x0000000000400000-0x00000000008DC000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1224-12-0x0000000000400000-0x00000000008DC000-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1224-6-0x00000000008D9FE0-mapping.dmp
    Download
  • memory/1704-17-0x0000000000400000-0x00000000006FE000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1704-9-0x0000000000400000-0x00000000006FE000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1704-10-0x00000000006FC1D0-mapping.dmp
    Download