Overview

overview

10

Static

static

3

SOA {JAN} ...sx.exe

windows7-x64

1

SOA {JAN} ...sx.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 06:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe

  • Size

    916KB

  • MD5

    1f153afa1eb2fc6c36833561df336720

  • SHA1

    702a477651fb5c0157eeafaf536cd5db47644ed7

  • SHA256

    4ea340bd4396f2dc2550ce2de10c7787242a29e2f0f2602b85f41a89e9059227

  • SHA512

    0d1d5949804651dd3ee72606a2a7386a4d84683e3ed9d3f7ce33f7a1edf274a6273ce6e2c5474451d8613a7a056865d2b823235951d786e6063d8057075cb660

  • SSDEEP

    12288:mEmzpE5j6jRPLjRPqjBjjyjBjBjBjBjLjG+jdgjkJtymmDXnUFmnwFMENYGvW53:tvILyJDcMAaIW5

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe
    "C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe
      "C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe"
      2⤵
        PID:2516
      • C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe
        "C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe"
        2⤵
          PID:1740
        • C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe
          "C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe"
          2⤵
            PID:2600
          • C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe
            "C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe"
            2⤵
              PID:1252
            • C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe
              "C:\Users\Admin\AppData\Local\Temp\SOA {JAN} & Swift HSBCCNSHXXX confirmation_xlsx.exe"
              2⤵
                PID:1988
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
              1⤵
                PID:2416

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2568-0-0x00000000742AE000-0x00000000742AF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2568-1-0x0000000000390000-0x000000000047C000-memory.dmp

                Filesize

                944KB

                Download

              • memory/2568-2-0x00000000742A0000-0x000000007498E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/2568-6-0x0000000000620000-0x000000000062A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/2568-7-0x00000000742AE000-0x00000000742AF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2568-8-0x00000000742A0000-0x000000007498E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/2568-9-0x0000000004E10000-0x0000000004E58000-memory.dmp

                Filesize

                288KB

                Download

              • memory/2568-10-0x00000000742A0000-0x000000007498E000-memory.dmp

                Filesize

                6.9MB

                Download