4ad33db217cd28e94e816da762375ed676740f21eee05f60be7785b27665cfbd

Analysis

Target
Bank Swift.doc.exe
Size 473KB
Sample220120-mbc4sahec4
SHA256 4ad33db217cd28e94e816da762375ed676740f21eee05f60be7785b27665cfbd
MD5 cb2f90f127deb8055bc861a7ef11cab8
SHA1 396c379fd25a09f327e74ac595b554ec01522d16
SHA512 5ca1ec2a74cbd6856ac674c698e16de1dcbfeeef9b344de741369cdf7d0cc885468c21086534de78b3e569ccbd9e14497beedc001d73b6c9b159677956bd8de9
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	Bank Swift.doc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1068	880	Bank Swift.doc.exe	27
PID 880 wrote to memory of 1068	880	Bank Swift.doc.exe	27
PID 880 wrote to memory of 1068	880	Bank Swift.doc.exe	27
PID 880 wrote to memory of 1068	880	Bank Swift.doc.exe	27
PID 880 wrote to memory of 664	880	Bank Swift.doc.exe	28
PID 880 wrote to memory of 664	880	Bank Swift.doc.exe	28
PID 880 wrote to memory of 664	880	Bank Swift.doc.exe	28
PID 880 wrote to memory of 664	880	Bank Swift.doc.exe	28
PID 880 wrote to memory of 1460	880	Bank Swift.doc.exe	29
PID 880 wrote to memory of 1460	880	Bank Swift.doc.exe	29
PID 880 wrote to memory of 1460	880	Bank Swift.doc.exe	29
PID 880 wrote to memory of 1460	880	Bank Swift.doc.exe	29
PID 880 wrote to memory of 1120	880	Bank Swift.doc.exe	30
PID 880 wrote to memory of 1120	880	Bank Swift.doc.exe	30
PID 880 wrote to memory of 1120	880	Bank Swift.doc.exe	30
PID 880 wrote to memory of 1120	880	Bank Swift.doc.exe	30
PID 880 wrote to memory of 616	880	Bank Swift.doc.exe	31
PID 880 wrote to memory of 616	880	Bank Swift.doc.exe	31
PID 880 wrote to memory of 616	880	Bank Swift.doc.exe	31
PID 880 wrote to memory of 616	880	Bank Swift.doc.exe	31

C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
  2⤵
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
  2⤵
  PID:616

memory/880-55-0x00000000003A0000-0x000000000041E000-memory.dmp

Download

memory/880-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

Download

memory/880-57-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/880-58-0x00000000005E0000-0x00000000005EC000-memory.dmp

Download

memory/880-59-0x0000000005170000-0x00000000051D0000-memory.dmp

Download