Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 01:41
General
- Target PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr
- Size 506KB
- Sample240809-b4f6csyamf
- SHA256 b81db352466d0a651374b1be399fc2f1b02b638c9a1786a2556d5d7919d2486e
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Detected Nirsoft tools 13 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr" /S1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr" /S2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr" /stext "C:\Users\Admin\AppData\Local\Temp\oujkfzoulfhladgwdnb"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr" /stext "C:\Users\Admin\AppData\Local\Temp\yowdgsywznzqkrcauywnwq"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT _USD39060-AUG-7-070224-000214.scr" /stext "C:\Users\Admin\AppData\Local\Temp\jibngkjpnvrdmyrmdiipzviovk"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
nsc72E4.tmp
nsc7381.tmp
System.dll
nsm72D3.tmp
nss72A2.tmp
nsx72C3.tmp
oujkfzoulfhladgwdnb
memory/2832-603-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2832-598-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2832-600-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2832-601-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3048-628-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-570-0x0000000077C15000-0x0000000077C16000-memory.dmp
memory/3048-575-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-576-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-571-0x00000000016D0000-0x00000000072BD000-memory.dmp
memory/3048-577-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-578-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-579-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-580-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-581-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-582-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-583-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-585-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-587-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-588-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-589-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-590-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-591-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-592-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-593-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-594-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-595-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-596-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-650-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-573-0x00000000004A4000-0x00000000004A5000-memory.dmp
memory/3048-649-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-648-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-611-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-647-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-646-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-572-0x0000000077B71000-0x0000000077C91000-memory.dmp
memory/3048-574-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-569-0x0000000077BF8000-0x0000000077BF9000-memory.dmp
memory/3048-645-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-644-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-615-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-643-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-620-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-621-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-642-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-627-0x0000000038010000-0x0000000038029000-memory.dmp
memory/3048-623-0x0000000038010000-0x0000000038029000-memory.dmp
memory/3048-626-0x0000000038010000-0x0000000038029000-memory.dmp
memory/3048-641-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-629-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-630-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-631-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-633-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-634-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-635-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-638-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-639-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3048-640-0x0000000000470000-0x00000000016C4000-memory.dmp
memory/3092-605-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3092-613-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3092-606-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3092-604-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3432-567-0x0000000077B71000-0x0000000077C91000-memory.dmp
memory/3432-568-0x0000000075015000-0x0000000075016000-memory.dmp
memory/4448-619-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4448-597-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4448-599-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4448-602-0x0000000000400000-0x0000000000478000-memory.dmp