Analysis
- max time kernel
151s - max time network
114s - platform
windows7_x64 - resource
win7v20210410 - submitted
22/04/2021, 06:14
General
- Target WaybillDoc_5736357561.pdf.exe
- Size 1.6MB
- Sample210422-v2emwffd2e
- SHA256 aba011b5f83793cebc1cfb4a1ef3aecbba7a3ea766abb459363b2d8bb51f3866
Malware Config
Signatures
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaybillDoc_5736357561.pdf.exe"C:\Users\Admin\AppData\Local\Temp\WaybillDoc_5736357561.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WaybillDoc_5736357561.pdf.exe"C:\Users\Admin\AppData\Local\Temp\WaybillDoc_5736357561.pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WaybillDoc_5736357561.pdf.exe"C:\Users\Admin\AppData\Local\Temp\WaybillDoc_5736357561.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/316-77-0x0000000000820000-0x0000000000821000-memory.dmp
memory/316-71-0x0000000000400000-0x00000000004D3000-memory.dmp
memory/316-70-0x0000000075EF1000-0x0000000075EF3000-memory.dmp
memory/316-66-0x0000000000400000-0x00000000004D3000-memory.dmp
memory/484-64-0x0000000005310000-0x000000000542E000-memory.dmp
memory/484-65-0x00000000078E0000-0x00000000079C0000-memory.dmp
memory/484-60-0x0000000001290000-0x0000000001291000-memory.dmp
memory/484-63-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/484-62-0x0000000000460000-0x0000000000469000-memory.dmp
memory/1884-72-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1884-75-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1884-78-0x0000000002490000-0x0000000002491000-memory.dmp