d0fcb3afeca9a0f16c39831bb2f1f6d4cf2b9fa5c26c3dde017b45e2f972ebc4

Analysis

Target
HSBC BANK LETTER.exe
Size 722KB
Sample220205-lrdjtaaba4
SHA256 07236ee497bab6187ef9e5ea42f6a184a9bb32030b50d88f251a449b03890305
MD5 c9f3af24ebda7a1bcaa94dc81156cf45
SHA1 14dff67f355616a09733afabff2cf836bf9ebe52
SHA512 719cfafe427d48211d4364954ac40bc714409b8b7a1b84cac8c208491daeee47418f25dd18b94800330485ed764539e0c62360913f59a04d44f3f87605f22663
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	612	svchost.exe
Token: SeCreatePagefilePrivilege	612	svchost.exe
Token: SeShutdownPrivilege	612	svchost.exe
Token: SeCreatePagefilePrivilege	612	svchost.exe
Token: SeShutdownPrivilege	612	svchost.exe
Token: SeCreatePagefilePrivilege	612	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2240	4960	HSBC BANK LETTER.exe	82
PID 4960 wrote to memory of 2240	4960	HSBC BANK LETTER.exe	82
PID 4960 wrote to memory of 2240	4960	HSBC BANK LETTER.exe	82
PID 2240 wrote to memory of 2812	2240	fondue.exe	83
PID 2240 wrote to memory of 2812	2240	fondue.exe	83

C:\Users\Admin\AppData\Local\Temp\HSBC BANK LETTER.exe
"C:\Users\Admin\AppData\Local\Temp\HSBC BANK LETTER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:2812

memory/612-130-0x000001B826B90000-0x000001B826BA0000-memory.dmp

Download

memory/612-137-0x000001B829910000-0x000001B829914000-memory.dmp

Download