3e6ebfbbecb76d3deabf5627ba3e988f7bace82e5645a2937d7f4da7e4110b17

General

Target

Payment Advise USD58k_pdf.exe
Size

856KB
MD5

63af72843ecd1c4b79836de725265d85
SHA1

5ee2398cceb7ca7344cf3f566203757354e0038b
SHA256

3e6ebfbbecb76d3deabf5627ba3e988f7bace82e5645a2937d7f4da7e4110b17
SHA512

584f10491312ddd75ac412d5c17ff0be8cc67fe566096e1a7c596d63b1f884fdc686c90f02b25e50b57b11a253dbc6ead4737a632fd8e2622f739509ba8eebb0
SSDEEP

12288:EZntXc87X+bXPXST4Fof1XUhegvLf4Rk7FT6JcbjCLt8Nm:4tXcH/X4yrvc6uDiNm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 4384 set thread context of 3444	4384	AddInProcess32.exe	57
PID 4384 set thread context of 2988	4384	AddInProcess32.exe	112
PID 2988 set thread context of 3444	2988	PATHPING.EXE	57

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
968	Payment Advise USD58k_pdf.exe
968	Payment Advise USD58k_pdf.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
4384	AddInProcess32.exe
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4384	AddInProcess32.exe
3444	Explorer.EXE
3444	Explorer.EXE
2988	PATHPING.EXE
2988	PATHPING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	Payment Advise USD58k_pdf.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3444	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 968 wrote to memory of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 968 wrote to memory of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 968 wrote to memory of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 968 wrote to memory of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 968 wrote to memory of 4384	968	Payment Advise USD58k_pdf.exe	100
PID 3444 wrote to memory of 2988	3444	Explorer.EXE	112
PID 3444 wrote to memory of 2988	3444	Explorer.EXE	112
PID 3444 wrote to memory of 2988	3444	Explorer.EXE	112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\Payment Advise USD58k_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Advise USD58k_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4384
- C:\Windows\SysWOW64\PATHPING.EXE
  "C:\Windows\SysWOW64\PATHPING.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-6-0x0000000006060000-0x00000000060A4000-memory.dmp

Filesize
272KB

Download
memory/968-10-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/968-2-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/968-3-0x0000000004DD0000-0x0000000004E62000-memory.dmp

Filesize
584KB

Download
memory/968-4-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download
memory/968-5-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/968-0-0x0000000000780000-0x000000000085C000-memory.dmp

Filesize
880KB

Download
memory/968-8-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/968-16-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/968-9-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/968-7-0x0000000006200000-0x000000000620A000-memory.dmp

Filesize
40KB

Download
memory/968-11-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/968-12-0x0000000007030000-0x000000000704A000-memory.dmp

Filesize
104KB

Download
memory/968-13-0x0000000007060000-0x0000000007066000-memory.dmp

Filesize
24KB

Download
memory/968-1-0x00000000752F0000-0x0000000075AA0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-22-0x00000000004C0000-0x00000000004FF000-memory.dmp

Filesize
252KB

Download
memory/2988-25-0x0000000000C10000-0x0000000000F5A000-memory.dmp

Filesize
3.3MB

Download
memory/2988-29-0x0000000000AD0000-0x0000000000B6D000-memory.dmp

Filesize
628KB

Download
memory/2988-28-0x00000000004C0000-0x00000000004FF000-memory.dmp

Filesize
252KB

Download
memory/2988-27-0x0000000000AD0000-0x0000000000B6D000-memory.dmp

Filesize
628KB

Download
memory/2988-21-0x00000000004C0000-0x00000000004FF000-memory.dmp

Filesize
252KB

Download
memory/2988-26-0x00000000004C0000-0x00000000004FF000-memory.dmp

Filesize
252KB

Download
memory/4384-20-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download
memory/4384-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4384-24-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download
memory/4384-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4384-17-0x00000000012F0000-0x000000000163A000-memory.dmp

Filesize
3.3MB

Download
memory/4384-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4384-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing