Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy Of Pending payment.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Swift Copy Of Pending payment.exe
Resource
win10v2004-20241007-en
General
-
Target
Swift Copy Of Pending payment.exe
-
Size
1.1MB
-
MD5
9b679868083e626372cfb2c14b41a1e7
-
SHA1
577dce2d101fbf4876b68ff6c3ad7ea4b165fa08
-
SHA256
a461236694dd8f695abc0e9ca8df64dcce9c9d3ac081e624ab7275dca99d4a5b
-
SHA512
61ea89bd7bd923c334c7730c9d10b8a65516c39fa78e0d59f65e43fb2112f2751649d28b47f5e9271e171809a7b7cd725edcd567ad671a1526fbaf80a1b31cfa
-
SSDEEP
24576:WfmMv6Ckr7Mny5Qtd5GWo1Bk8bJKcdO3uZMYBBvWNaiT7sq:W3v+7/5QtLGWoD9I6ZMYBBOIiT7sq
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lymnaeidae.vbs Lymnaeidae.exe -
Executes dropped EXE 1 IoCs
pid Process 2980 Lymnaeidae.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023b8a-5.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1020 2980 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lymnaeidae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Swift Copy Of Pending payment.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2980 2244 Swift Copy Of Pending payment.exe 87 PID 2244 wrote to memory of 2980 2244 Swift Copy Of Pending payment.exe 87 PID 2244 wrote to memory of 2980 2244 Swift Copy Of Pending payment.exe 87 PID 2980 wrote to memory of 1548 2980 Lymnaeidae.exe 90 PID 2980 wrote to memory of 1548 2980 Lymnaeidae.exe 90 PID 2980 wrote to memory of 1548 2980 Lymnaeidae.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\contrapose\Lymnaeidae.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Of Pending payment.exe"3⤵PID:1548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 7083⤵
- Program crash
PID:1020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2980 -ip 29801⤵PID:2976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD59681c86859fa8bc92f87977f64f1cba7
SHA1c50d1646a314e6e4ad0f8d868c7ed101288be380
SHA256b99bd48a1f467328420932c5a569b55659876aa124fbb0bc29c2e2cae660f1b2
SHA512b975c6e6589d44e61e2bc707eaeea4b2732b7eb14a11cab2e95d1f2532580567c556252f54b2cb5a88a38dccd77301d1b6959a213df1e8c7a2a5fe2d5cfc375b
-
Filesize
1.1MB
MD59b679868083e626372cfb2c14b41a1e7
SHA1577dce2d101fbf4876b68ff6c3ad7ea4b165fa08
SHA256a461236694dd8f695abc0e9ca8df64dcce9c9d3ac081e624ab7275dca99d4a5b
SHA51261ea89bd7bd923c334c7730c9d10b8a65516c39fa78e0d59f65e43fb2112f2751649d28b47f5e9271e171809a7b7cd725edcd567ad671a1526fbaf80a1b31cfa