259ee3ef84b0d00f8a58cec6f325c60e51f15956130135319cb4b782710d801f

General

Target

Payment invoice.exe
Size

699KB
MD5

7d2dffc850ea555d40c45f09570475c7
SHA1

6cc0693502bc8caefcde997e260b0798b4fbde1e
SHA256

aa6aaa2be3d8cc64ad42be11e2cd924bddf7bdb46780ec3bc2b8ac2032c3ad89
SHA512

1e2036443166fea107ba4aab7ea4a5b991761c00d2b8e55ca17cb44fa06e9fbe09fb2c18979034af20be6f2d15c62880bcfcf8854b746080cc827e89a52ef865
SSDEEP

12288:6e37i8LkpEaIptKciGsJn4k4k0sa+NU89WJGTxUQvPCQv1ZdI7n0xRviwkR:6AOjEzpsrJ4kVh99WkUQvqQNZS0xRA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 1628	1504	Payment invoice.exe	28
PID 1628 set thread context of 1196	1628	RegSvcs.exe	21
PID 1628 set thread context of 1568	1628	RegSvcs.exe	29
PID 1568 set thread context of 1196	1568	iexpress.exe	21

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1504	Payment invoice.exe
1504	Payment invoice.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1628	RegSvcs.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe
1568	iexpress.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1628	RegSvcs.exe
1196	Explorer.EXE
1196	Explorer.EXE
1568	iexpress.exe
1568	iexpress.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	Payment invoice.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1504 wrote to memory of 1628	1504	Payment invoice.exe	28
PID 1196 wrote to memory of 1568	1196	Explorer.EXE	29
PID 1196 wrote to memory of 1568	1196	Explorer.EXE	29
PID 1196 wrote to memory of 1568	1196	Explorer.EXE	29
PID 1196 wrote to memory of 1568	1196	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Payment invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment invoice.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1628
- C:\Windows\SysWOW64\iexpress.exe
  "C:\Windows\SysWOW64\iexpress.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-26-0x00000000002C0000-0x00000000003C0000-memory.dmp

Filesize
1024KB

Download
memory/1196-18-0x0000000003BA0000-0x0000000003CA0000-memory.dmp

Filesize
1024KB

Download
memory/1504-1-0x0000000000C20000-0x0000000000CD2000-memory.dmp

Filesize
712KB

Download
memory/1504-2-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/1504-3-0x0000000000990000-0x00000000009AA000-memory.dmp

Filesize
104KB

Download
memory/1504-4-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/1504-5-0x0000000005260000-0x00000000052EA000-memory.dmp

Filesize
552KB

Download
memory/1504-0-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/1504-12-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/1568-27-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1568-28-0x0000000000440000-0x00000000004DE000-memory.dmp

Filesize
632KB

Download
memory/1568-25-0x0000000000440000-0x00000000004DE000-memory.dmp

Filesize
632KB

Download
memory/1568-24-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1568-23-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

Filesize
3.0MB

Download
memory/1568-20-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1568-19-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1628-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1628-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1628-17-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/1628-22-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/1628-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1628-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1628-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1628-13-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/1628-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1628-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1628-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing