1e50357fded875a8e7fdc8bc2237c28276031328ae0fc295ac9bad83a6bb3e19

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transferencia-Caixa Bank.exe
Size 657KB
Sample240508-emtxnscc84
SHA256 fdc8fddeb50b8dd709e3580c0eac02613406602eff4ccbd2903722b7157ef30b
MD5 6c4bff2dd423151cc9ccd9b1f3191172
SHA1 0d38351ccbfc6ba4611b2d9d7ce46792fdfb0409
SHA512 1b1aa360f316ce36cdc265331bd1e20023e703d440bbeafe8380172b2268cb5e48731f23cf99f8770ccac905d4abfd1e960bde7a41c8d09426082505458ec162
SSDEEP 12288:KDq0UuJpoDwHuPVyBMwQpwU0TvGvpvIY/4h:KOpuJpoDqWV1wo6ypv6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1176	Transferencia-Caixa Bank.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sdeliges.hav	Transferencia-Caixa Bank.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1176	Transferencia-Caixa Bank.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\sulidae.imp	Transferencia-Caixa Bank.exe
File opened for modification	C:\Program Files (x86)\Common Files\hidse.inc	Transferencia-Caixa Bank.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\braknses\overvejende.myo	Transferencia-Caixa Bank.exe
File opened for modification	C:\Windows\resources\0409\Keypads\bundproppernes.Goy182	Transferencia-Caixa Bank.exe
File opened for modification	C:\Windows\indgiv.syd	Transferencia-Caixa Bank.exe
File opened for modification	C:\Windows\afrits.ini	Transferencia-Caixa Bank.exe
File opened for modification	C:\Windows\Fonts\Commodores69.ryk	Transferencia-Caixa Bank.exe
File opened for modification	C:\Windows\resources\lejlighedsdigtes\isosmotically.pin	Transferencia-Caixa Bank.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1832	1176	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1832	1176	Transferencia-Caixa Bank.exe	31
PID 1176 wrote to memory of 1832	1176	Transferencia-Caixa Bank.exe	31
PID 1176 wrote to memory of 1832	1176	Transferencia-Caixa Bank.exe	31
PID 1176 wrote to memory of 1832	1176	Transferencia-Caixa Bank.exe	31

C:\Users\Admin\AppData\Local\Temp\Transferencia-Caixa Bank.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia-Caixa Bank.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 488
  2⤵
  - Program crash
  PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nsj92EE.tmp\System.dll
Size 11KB
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1176-110-0x0000000003870000-0x0000000004DFF000-memory.dmp

Download

memory/1176-111-0x0000000077801000-0x0000000077902000-memory.dmp

Download

memory/1176-112-0x0000000003870000-0x0000000004DFF000-memory.dmp

Download

memory/1176-113-0x0000000077800000-0x00000000779A9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads