a567fb9318d264cc80e334cef437c32da976282553a292df76899ac7410f4503

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HSBC_Payment.exe
Size

622KB
MD5

a1b6b44f97ac8e1efd21bd9fa5abe56d
SHA1

2f56cfe23e6524d8ee0e33772c4c4e5ae2e74885
SHA256

a567fb9318d264cc80e334cef437c32da976282553a292df76899ac7410f4503
SHA512

2ff995bba25e85e11b59f19ef50332bec8e8603af5d95a9d2d6a4ca0b0bafdc8f1654a8dc9580d1b61040c2b064355a7dfd65f51faca2698095d13e8ae780d55
SSDEEP

6144:vYa6vEsNe5YZ0thEQfEkJSgC7M/1RuCt/Po7U8Mq3n39D3nEkxVPaEnIW2KkR4hV:vY+T5LbpJS1M/OlbMgn39DXVfPa62K66

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2648	HSBC_Payment.exe
2648	HSBC_Payment.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2648	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HSBC_Payment.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2672	2648	HSBC_Payment.exe	30
PID 2648 wrote to memory of 2672	2648	HSBC_Payment.exe	30
PID 2648 wrote to memory of 2672	2648	HSBC_Payment.exe	30
PID 2648 wrote to memory of 2672	2648	HSBC_Payment.exe	30

C:\Users\Admin\AppData\Local\Temp\HSBC_Payment.exe
"C:\Users\Admin\AppData\Local\Temp\HSBC_Payment.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 532
  2⤵
  - Program crash
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd88C1.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/2648-18-0x0000000004040000-0x0000000006F55000-memory.dmp

Filesize
47.1MB

Download
memory/2648-19-0x0000000004040000-0x0000000006F55000-memory.dmp

Filesize
47.1MB

Download