923a3c45ee78a4f7354e94eba65cfb6ddd5cf19c50391bc4d95efa0dfff7f526

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Proforma Invoice and Bank swift-REG.PI-0086547654.exe
Size

218KB
MD5

b148ae414eb8a1b34a15cdb32c21f9ee
SHA1

25b78f76010cc34843352c78d4f8e07a28b46b32
SHA256

193788545c12c697fe660e9dd178e5d97478d5b90d5b0096f1cd6a9b641d48e9
SHA512

9f6efbfdd1ab7bed6e0efcff882fd05816c0cbb6b413abce562f1ab6c8adbfa2d86610299be8d399ba36a305b64cadc762806eaa4c647d9b04fd457ec1537d0a
SSDEEP

6144:Ds9G4RsUIfpwRmZfqJxbx3jjTQeGYWAaE:yG45IfpTIxV3jHQeGYn

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2636	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Proforma Invoice and Bank swift-REG.PI-0086547654.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe
2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1304	2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	83
PID 2636 wrote to memory of 1304	2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	83
PID 2636 wrote to memory of 1304	2636	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	83

C:\Users\Admin\AppData\Local\Temp\Proforma Invoice and Bank swift-REG.PI-0086547654.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice and Bank swift-REG.PI-0086547654.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\Proforma Invoice and Bank swift-REG.PI-0086547654.exe
  "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice and Bank swift-REG.PI-0086547654.exe"
  2⤵
  PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 872
  2⤵
  - Program crash
  PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2636 -ip 2636
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsmA4FC.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit