6577f5c5150e1dc818be87c2483db10b3af00effc2faf5c1acd174a8db760001

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06-11-2023 16:50

Target

Remittance Advice.exe
Size

351KB
MD5

d110b0f2602558c3d8b88de7cfe037f5
SHA1

5f793d032ab11aca6877ab37df9b4f9c2d681afa
SHA256

6577f5c5150e1dc818be87c2483db10b3af00effc2faf5c1acd174a8db760001
SHA512

ae5a8b3686d68df8bd5bf1ab1c27626d251e119392b0a3b2c40b36b38d2077c3147c4f2e47e9899fe8be9b178d0bd18cda080de06fe007af0245d651f6e2abd9
SSDEEP

6144:N79QdWMg8s6TiYedIEyqS5gSDA8X0w68/lE1nwXvOQNBrrIya/EZD7dU:XsY6Ti7dIEVSOS83b2WQNBvko7m

Score

7^/10

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

1468 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 1468 Powershell.exe

pid	process
1468	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	1468	Powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Remittance Advice.exe

description	pid	process	target process
PID 2016 wrote to memory of 1468	2016	Remittance Advice.exe	Powershell.exe
PID 2016 wrote to memory of 1468	2016	Remittance Advice.exe	Powershell.exe
PID 2016 wrote to memory of 1468	2016	Remittance Advice.exe	Powershell.exe
PID 2016 wrote to memory of 1468	2016	Remittance Advice.exe	Powershell.exe
PID 2016 wrote to memory of 2920	2016	Remittance Advice.exe	Remittance Advice.exe
PID 2016 wrote to memory of 2920	2016	Remittance Advice.exe	Remittance Advice.exe
PID 2016 wrote to memory of 2920	2016	Remittance Advice.exe	Remittance Advice.exe
PID 2016 wrote to memory of 2920	2016	Remittance Advice.exe	Remittance Advice.exe

C:\Users\Admin\AppData\Local\Temp\Remittance Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance Advice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\Remittance Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance Advice.exe"
2⤵
PID:2920

memory/1468-5-0x000000006FF20000-0x00000000704CB000-memory.dmp

Filesize
5.7MB

Download
memory/1468-6-0x000000006FF20000-0x00000000704CB000-memory.dmp

Filesize
5.7MB

Download
memory/1468-7-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/1468-8-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/1468-12-0x000000006FF20000-0x00000000704CB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-0-0x0000000000200000-0x000000000025E000-memory.dmp

Filesize
376KB

Download
memory/2016-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2016-2-0x00000000005E0000-0x0000000000636000-memory.dmp

Filesize
344KB

Download
memory/2016-9-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/2016-10-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download