Analysis
- max time kernel
119s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
23/11/2021, 10:45
General
- Target Swift_HSBC_0099087645PDF.exe
- Size 559KB
- Sample211123-mtd4sshggm
- SHA256 d5736edad6679da3cee555c2ae3a023f1ca86f6ed4a7cf37832a0b352225fad1
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift_HSBC_0099087645PDF.exe"C:\Users\Admin\AppData\Local\Temp\Swift_HSBC_0099087645PDF.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3056-118-0x0000000000140000-0x0000000000141000-memory.dmp
memory/3056-120-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/3056-121-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/3056-122-0x0000000004AD0000-0x0000000004FCE000-memory.dmp