Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy Of Pending payment.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Swift Copy Of Pending payment.exe
Resource
win10v2004-20241007-en
General
-
Target
Swift Copy Of Pending payment.exe
-
Size
1.1MB
-
MD5
9b679868083e626372cfb2c14b41a1e7
-
SHA1
577dce2d101fbf4876b68ff6c3ad7ea4b165fa08
-
SHA256
a461236694dd8f695abc0e9ca8df64dcce9c9d3ac081e624ab7275dca99d4a5b
-
SHA512
61ea89bd7bd923c334c7730c9d10b8a65516c39fa78e0d59f65e43fb2112f2751649d28b47f5e9271e171809a7b7cd725edcd567ad671a1526fbaf80a1b31cfa
-
SSDEEP
24576:WfmMv6Ckr7Mny5Qtd5GWo1Bk8bJKcdO3uZMYBBvWNaiT7sq:W3v+7/5QtLGWoD9I6ZMYBBOIiT7sq
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lymnaeidae.vbs Lymnaeidae.exe -
Executes dropped EXE 2 IoCs
pid Process 1960 Lymnaeidae.exe 1196 Lymnaeidae.exe -
Loads dropped DLL 1 IoCs
pid Process 2436 Swift Copy Of Pending payment.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000019246-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1196 set thread context of 2808 1196 Lymnaeidae.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Swift Copy Of Pending payment.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lymnaeidae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lymnaeidae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2808 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1960 Lymnaeidae.exe 1196 Lymnaeidae.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2808 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1960 2436 Swift Copy Of Pending payment.exe 31 PID 2436 wrote to memory of 1960 2436 Swift Copy Of Pending payment.exe 31 PID 2436 wrote to memory of 1960 2436 Swift Copy Of Pending payment.exe 31 PID 2436 wrote to memory of 1960 2436 Swift Copy Of Pending payment.exe 31 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 2408 1960 Lymnaeidae.exe 32 PID 1960 wrote to memory of 1196 1960 Lymnaeidae.exe 33 PID 1960 wrote to memory of 1196 1960 Lymnaeidae.exe 33 PID 1960 wrote to memory of 1196 1960 Lymnaeidae.exe 33 PID 1960 wrote to memory of 1196 1960 Lymnaeidae.exe 33 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 PID 1196 wrote to memory of 2808 1196 Lymnaeidae.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\contrapose\Lymnaeidae.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"3⤵PID:2408
-
-
C:\Users\Admin\AppData\Local\contrapose\Lymnaeidae.exe"C:\Users\Admin\AppData\Local\contrapose\Lymnaeidae.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\contrapose\Lymnaeidae.exe"4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2808
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59b679868083e626372cfb2c14b41a1e7
SHA1577dce2d101fbf4876b68ff6c3ad7ea4b165fa08
SHA256a461236694dd8f695abc0e9ca8df64dcce9c9d3ac081e624ab7275dca99d4a5b
SHA51261ea89bd7bd923c334c7730c9d10b8a65516c39fa78e0d59f65e43fb2112f2751649d28b47f5e9271e171809a7b7cd725edcd567ad671a1526fbaf80a1b31cfa