9acb3802e7f15ac9c240749ff8c3ebe7a7cd660bedf4b6a6a1edef4de714aa43

General

Target

863037-Remittance Copy.exe
Size

565KB
MD5

5869b519a2ccb89f10567b53853a4d22
SHA1

c9e9d335d1a2413ed5aacfdc41ff1cfdbb0d899f
SHA256

9acb3802e7f15ac9c240749ff8c3ebe7a7cd660bedf4b6a6a1edef4de714aa43
SHA512

c5c3d25b7f13cc3659bf870c33529ade660defbfe856af336e808a6c583cd4bd700a0d7105c4f6567c1eb95dd38186c27840226dcb79fafdd99ca020402fc699
SSDEEP

12288:NHaiZscgfKciEpjetvBGtS1gIjVrKVXug+0lnX:+ViUub1RjVre+g+0l

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2572 set thread context of 2812	2572	863037-Remittance Copy.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2572	863037-Remittance Copy.exe
2812	863037-Remittance Copy.exe
2812	863037-Remittance Copy.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	863037-Remittance Copy.exe
Token: SeDebugPrivilege	2812	863037-Remittance Copy.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2700	2572	863037-Remittance Copy.exe	30
PID 2572 wrote to memory of 2700	2572	863037-Remittance Copy.exe	30
PID 2572 wrote to memory of 2700	2572	863037-Remittance Copy.exe	30
PID 2572 wrote to memory of 2700	2572	863037-Remittance Copy.exe	30
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32
PID 2572 wrote to memory of 2812	2572	863037-Remittance Copy.exe	32

C:\Users\Admin\AppData\Local\Temp\863037-Remittance Copy.exe
"C:\Users\Admin\AppData\Local\Temp\863037-Remittance Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ekybpZarpIGq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8E0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\863037-Remittance Copy.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF8E0.tmp

Filesize
1KB

MD5
0cf5a624b38c22ad230394e2e101cd23

SHA1
657b0cd6942926313570bb734884feab49d6a756

SHA256
6f59b3b8c762381ae08343e807ab28f2a20e29cbd5860530bab9ff2bb2e907b3

SHA512
eca0eea6484d2998c7266c4443b00ed1e3a2b74aefabc31209ca50939657ab85b39387376a20c92a463c54ecafb8655d55d10e35bd3494b20d3304e3ab7cedd3

Download Submit
memory/2572-0-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2572-1-0x0000000001140000-0x00000000011D4000-memory.dmp

Filesize
592KB

Download
memory/2572-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2572-3-0x00000000002B0000-0x00000000002BC000-memory.dmp

Filesize
48KB

Download
memory/2572-4-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2572-5-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2572-6-0x00000000053F0000-0x000000000548A000-memory.dmp

Filesize
616KB

Download
memory/2572-7-0x00000000010D0000-0x000000000112C000-memory.dmp

Filesize
368KB

Download
memory/2572-25-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2812-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2812-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-23-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2812-24-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2812-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-26-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2812-27-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads