Analysis
-
max time kernel
90s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 15:11
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_PAYMENT_COPY.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
HSBC_PAYMENT_COPY.pdf.exe
Resource
win10v20210410
General
-
Target
HSBC_PAYMENT_COPY.pdf.exe
-
Size
1.4MB
-
MD5
08f2609e7f7daf0f78032f773a68b72c
-
SHA1
f00e4c61cce15ee5f43c032d8d595aba65fbdc86
-
SHA256
0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253
-
SHA512
8c1ba503d2956ad0c60b11547908b81e601a3bfb2c75ae73c03718bd883ff94451b0697f915049614470d59388d161c02893ad90b48466f77fc154a20215da74
Malware Config
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2744-141-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/2744-142-0x000000000049D8CA-mapping.dmp family_webmonitor behavioral2/memory/2744-159-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/3368-121-0x0000000004D40000-0x0000000004D4B000-memory.dmp CustAttr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HSBC_PAYMENT_COPY.pdf.exedescription pid process target process PID 3368 set thread context of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
HSBC_PAYMENT_COPY.pdf.exepowershell.exepowershell.exepowershell.exepid process 3368 HSBC_PAYMENT_COPY.pdf.exe 3376 powershell.exe 1264 powershell.exe 2584 powershell.exe 3376 powershell.exe 1264 powershell.exe 2584 powershell.exe 1264 powershell.exe 3376 powershell.exe 2584 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
HSBC_PAYMENT_COPY.pdf.exepowershell.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3368 HSBC_PAYMENT_COPY.pdf.exe Token: SeDebugPrivilege 1264 powershell.exe Token: SeDebugPrivilege 3376 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe Token: SeShutdownPrivilege 2744 RegSvcs.exe Token: SeCreatePagefilePrivilege 2744 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
HSBC_PAYMENT_COPY.pdf.exeRegSvcs.exedescription pid process target process PID 3368 wrote to memory of 3376 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 3376 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 3376 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 1264 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 1264 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 1264 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 2212 3368 HSBC_PAYMENT_COPY.pdf.exe schtasks.exe PID 3368 wrote to memory of 2212 3368 HSBC_PAYMENT_COPY.pdf.exe schtasks.exe PID 3368 wrote to memory of 2212 3368 HSBC_PAYMENT_COPY.pdf.exe schtasks.exe PID 3368 wrote to memory of 2584 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 2584 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 2584 3368 HSBC_PAYMENT_COPY.pdf.exe powershell.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 3368 wrote to memory of 2744 3368 HSBC_PAYMENT_COPY.pdf.exe RegSvcs.exe PID 2744 wrote to memory of 3856 2744 RegSvcs.exe cmd.exe PID 2744 wrote to memory of 3856 2744 RegSvcs.exe cmd.exe PID 2744 wrote to memory of 3856 2744 RegSvcs.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HSBC_PAYMENT_COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_PAYMENT_COPY.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HSBC_PAYMENT_COPY.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WTddvQz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp101E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hlaVAn6udZ4CwxyY.bat" "3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WTddvQz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
f4615b766787c42971caadbf212f9e17
SHA12526cc5735b5d96f9aeb866431d5c4a99dff0368
SHA256855bf70438c2babcf22ee02503f8c7582c6c871c6cb9eab8395eb373a7d7bf4c
SHA512c97e23e7513c937233cfbac01db68a1dc81c2bb85a7af11e1e5e80cab672d85a435e5a70d41d969d73be06fa7df09ea40e21b76c61542e9eb107b61cbc6c33b9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
72b19e19f2c58e2b573c54d1b34b0d7c
SHA1e5d07d9ad524a538514c0511a91320a5e17b42c2
SHA25659a63e7f8e2e04abf9528f8e0e4c26548633c0c24c5d4892aafec4184d748a09
SHA512d20f32a534c70373207fddd5a80b200f18909f9461263febf97e454fc32089aed59073aff79128c259ce7a8ed9118bebc7000c3314c0632a640f1272d7143c64
-
C:\Users\Admin\AppData\Local\Temp\hlaVAn6udZ4CwxyY.batMD5
f0c03cf7c59ae01c18e406bfb5c4978a
SHA1e9ad9fbc65bfdd2c261332a4956175e702d0d3ca
SHA256ce93fcc2430ee5a5236e32d72b78f4f4e4870847fa882f57ee98b2d341fa7bdb
SHA5128f894432dec319770b3c3292dc16034e40f064a583bdfdc52930d6a28ff4ff3e5a58a8c4cb3b921d51bd82e28207b3ba6255ef4fb43ce4de85d706d2b25b2793
-
C:\Users\Admin\AppData\Local\Temp\tmp101E.tmpMD5
b09c39ec8d3fe0050b3f5742571b0a7a
SHA12b185059761351b3466fb8c1d2eba182b1b99beb
SHA256f676c7c0ee5734bc5326878ece55ce7916e7b2d3c6c9faa6f2fbb7ced4cefeab
SHA5121847f0a3396cfedc1b457d511f828a763ab6bc6808f5df864521311bad166dc53b2e6662160fbd853e56406a788e40721b4683516163ab8b8c44361555d84ef9
-
memory/1264-138-0x0000000006A70000-0x0000000006A71000-memory.dmpFilesize
4KB
-
memory/1264-271-0x0000000006A73000-0x0000000006A74000-memory.dmpFilesize
4KB
-
memory/1264-166-0x0000000008150000-0x0000000008151000-memory.dmpFilesize
4KB
-
memory/1264-188-0x00000000090E0000-0x0000000009113000-memory.dmpFilesize
204KB
-
memory/1264-214-0x000000007E1E0000-0x000000007E1E1000-memory.dmpFilesize
4KB
-
memory/1264-125-0x0000000000000000-mapping.dmp
-
memory/1264-140-0x0000000006A72000-0x0000000006A73000-memory.dmpFilesize
4KB
-
memory/1264-217-0x0000000009220000-0x0000000009221000-memory.dmpFilesize
4KB
-
memory/2212-126-0x0000000000000000-mapping.dmp
-
memory/2584-160-0x0000000007340000-0x0000000007341000-memory.dmpFilesize
4KB
-
memory/2584-263-0x000000007F680000-0x000000007F681000-memory.dmpFilesize
4KB
-
memory/2584-275-0x0000000007343000-0x0000000007344000-memory.dmpFilesize
4KB
-
memory/2584-139-0x0000000000000000-mapping.dmp
-
memory/2584-161-0x0000000007342000-0x0000000007343000-memory.dmpFilesize
4KB
-
memory/2744-141-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/2744-142-0x000000000049D8CA-mapping.dmp
-
memory/2744-159-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3368-121-0x0000000004D40000-0x0000000004D4B000-memory.dmpFilesize
44KB
-
memory/3368-114-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/3368-116-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/3368-117-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/3368-118-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3368-119-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/3368-120-0x00000000052A0000-0x000000000579E000-memory.dmpFilesize
5.0MB
-
memory/3368-123-0x00000000090D0000-0x00000000091C5000-memory.dmpFilesize
980KB
-
memory/3368-122-0x0000000008EF0000-0x0000000009015000-memory.dmpFilesize
1.1MB
-
memory/3376-143-0x0000000006C10000-0x0000000006C11000-memory.dmpFilesize
4KB
-
memory/3376-267-0x0000000000F33000-0x0000000000F34000-memory.dmpFilesize
4KB
-
memory/3376-201-0x0000000008A40000-0x0000000008A41000-memory.dmpFilesize
4KB
-
memory/3376-162-0x00000000073B0000-0x00000000073B1000-memory.dmpFilesize
4KB
-
memory/3376-152-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/3376-216-0x000000007EA60000-0x000000007EA61000-memory.dmpFilesize
4KB
-
memory/3376-147-0x0000000006CF0000-0x0000000006CF1000-memory.dmpFilesize
4KB
-
memory/3376-164-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/3376-149-0x00000000074C0000-0x00000000074C1000-memory.dmpFilesize
4KB
-
memory/3376-137-0x0000000000F32000-0x0000000000F33000-memory.dmpFilesize
4KB
-
memory/3376-124-0x0000000000000000-mapping.dmp
-
memory/3376-136-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/3376-132-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB
-
memory/3376-129-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/3856-450-0x0000000000000000-mapping.dmp