3e6ebfbbecb76d3deabf5627ba3e988f7bace82e5645a2937d7f4da7e4110b17

General

Target

Payment Advise USD58k_pdf.exe
Size

856KB
MD5

63af72843ecd1c4b79836de725265d85
SHA1

5ee2398cceb7ca7344cf3f566203757354e0038b
SHA256

3e6ebfbbecb76d3deabf5627ba3e988f7bace82e5645a2937d7f4da7e4110b17
SHA512

584f10491312ddd75ac412d5c17ff0be8cc67fe566096e1a7c596d63b1f884fdc686c90f02b25e50b57b11a253dbc6ead4737a632fd8e2622f739509ba8eebb0
SSDEEP

12288:EZntXc87X+bXPXST4Fof1XUhegvLf4Rk7FT6JcbjCLt8Nm:4tXcH/X4yrvc6uDiNm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2484 set thread context of 1192	2484	AddInProcess32.exe	21
PID 2484 set thread context of 2004	2484	AddInProcess32.exe	31
PID 2004 set thread context of 1192	2004	PATHPING.EXE	21

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2868	Payment Advise USD58k_pdf.exe
2868	Payment Advise USD58k_pdf.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2484	AddInProcess32.exe
2004	PATHPING.EXE
2004	PATHPING.EXE
2004	PATHPING.EXE
2004	PATHPING.EXE
2004	PATHPING.EXE
2004	PATHPING.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2484	AddInProcess32.exe
1192	Explorer.EXE
1192	Explorer.EXE
2004	PATHPING.EXE
2004	PATHPING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	Payment Advise USD58k_pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 2868 wrote to memory of 2484	2868	Payment Advise USD58k_pdf.exe	30
PID 1192 wrote to memory of 2004	1192	Explorer.EXE	31
PID 1192 wrote to memory of 2004	1192	Explorer.EXE	31
PID 1192 wrote to memory of 2004	1192	Explorer.EXE	31
PID 1192 wrote to memory of 2004	1192	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Payment Advise USD58k_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Advise USD58k_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2484
- C:\Windows\SysWOW64\PATHPING.EXE
  "C:\Windows\SysWOW64\PATHPING.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-23-0x0000000002D30000-0x0000000002E30000-memory.dmp

Filesize
1024KB

Download
memory/1192-32-0x0000000008BE0000-0x000000000BC36000-memory.dmp

Filesize
48.3MB

Download
memory/1192-24-0x0000000008BE0000-0x000000000BC36000-memory.dmp

Filesize
48.3MB

Download
memory/2004-33-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2004-31-0x0000000000860000-0x00000000008FD000-memory.dmp

Filesize
628KB

Download
memory/2004-30-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2004-29-0x00000000009F0000-0x0000000000CF3000-memory.dmp

Filesize
3.0MB

Download
memory/2004-26-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2004-25-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2484-18-0x0000000000B10000-0x0000000000E13000-memory.dmp

Filesize
3.0MB

Download
memory/2484-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-28-0x00000000001A0000-0x00000000001BE000-memory.dmp

Filesize
120KB

Download
memory/2484-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-22-0x00000000001A0000-0x00000000001BE000-memory.dmp

Filesize
120KB

Download
memory/2868-0-0x0000000001170000-0x000000000124C000-memory.dmp

Filesize
880KB

Download
memory/2868-8-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2868-7-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2868-6-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2868-17-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-14-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2868-5-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2868-4-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-3-0x0000000001110000-0x0000000001154000-memory.dmp

Filesize
272KB

Download
memory/2868-2-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2868-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing