Analysis
-
max time kernel
77s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-05-2022 05:11
Static task
static1
Behavioral task
behavioral1
Sample
Payment Confirmation Ref-876627.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
Payment Confirmation Ref-876627.exe
-
Size
1.1MB
-
MD5
2d75aafb29ad71871745dce716de4517
-
SHA1
23f737a59884324f91c86af756f97f272e07cedc
-
SHA256
58274c41a987c806022f227b6df900bb1bd3fab9a7a87a3d34a5bd4f1b58980d
-
SHA512
491500861bfe415470e2dba2aaa448bf3ab9056e49a1e753835a59a6925de56c5947b794d564fbc83d948361fd3f0a60ae7a4c9acfd2896397636bdc51b7f7b1
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Payment Confirmation Ref-876627.exepid process 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe 2480 Payment Confirmation Ref-876627.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Confirmation Ref-876627.exedescription pid process Token: SeDebugPrivilege 2480 Payment Confirmation Ref-876627.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2480-130-0x0000000002690000-0x00000000027B9000-memory.dmpFilesize
1.2MB
-
memory/2480-131-0x000000000DF50000-0x000000000E065000-memory.dmpFilesize
1.1MB
-
memory/2480-132-0x000000000DF50000-0x000000000E065000-memory.dmpFilesize
1.1MB
-
memory/2480-133-0x000000000DF50000-0x000000000DF60000-memory.dmpFilesize
64KB
-
memory/2480-134-0x000000000DF50000-0x000000000DF60000-memory.dmpFilesize
64KB
-
memory/2480-135-0x0000000005300000-0x0000000005918000-memory.dmpFilesize
6.1MB
-
memory/2480-136-0x0000000004DA0000-0x0000000004DB2000-memory.dmpFilesize
72KB
-
memory/2480-137-0x0000000004ED0000-0x0000000004FDA000-memory.dmpFilesize
1.0MB
-
memory/2480-138-0x0000000004E00000-0x0000000004E3C000-memory.dmpFilesize
240KB
-
memory/2480-139-0x0000000005E80000-0x0000000005EF6000-memory.dmpFilesize
472KB
-
memory/2480-140-0x0000000005FA0000-0x0000000006032000-memory.dmpFilesize
584KB
-
memory/2480-141-0x00000000065F0000-0x0000000006B94000-memory.dmpFilesize
5.6MB
-
memory/2480-142-0x0000000006180000-0x000000000619E000-memory.dmpFilesize
120KB
-
memory/2480-143-0x0000000006380000-0x00000000063E6000-memory.dmpFilesize
408KB
-
memory/2480-144-0x00000000063F0000-0x0000000006440000-memory.dmpFilesize
320KB
-
memory/2480-145-0x0000000006D70000-0x0000000006F32000-memory.dmpFilesize
1.8MB
-
memory/2480-146-0x0000000007470000-0x000000000799C000-memory.dmpFilesize
5.2MB