Analysis

  • max time kernel
    107s
  • max time network
    120s
  • resource
    win7v191014

General

  • Target

    d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc

  • Sample

    191025-blt53ekjex

  • SHA256

    d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc

Score
N/A

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Adds Run entry to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc.exe
    "C:\Users\Admin\AppData\Local\Temp\d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Adds Run entry to start application
    • Suspicious use of WriteProcessMemory
    PID:1492
  • C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\118cdf94-d654-46e1-aaf9-305da54aed73" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    1⤵
      PID:1968
    • C:\Users\Admin\AppData\Local\Temp\d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc.exe
      "C:\Users\Admin\AppData\Local\Temp\d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc.exe" --Admin IsNotAutoStart IsNotTask
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Modifies system certificate store
      PID:1068

    Network

    MITRE ATT&CK Enterprise v15

    MITRE ATT&CK Additional techniques

    • T1060
    • T1130

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    • C:\Users\Admin\AppData\Local\118cdf94-d654-46e1-aaf9-305da54aed73\d95a38a7c3ba130e354926102de8f64986d8248ee095e5e410d6ee410d74e0bc.exe

    • memory/1068-3-0x0000000000330000-0x00000000003C4000-memory.dmp

      Filesize

      592KB

    • memory/1068-4-0x0000000004FD0000-0x0000000004FE1000-memory.dmp

      Filesize

      68KB

    • memory/1492-0-0x0000000000320000-0x00000000003B4000-memory.dmp

      Filesize

      592KB

    • memory/1492-1-0x0000000004FC0000-0x0000000004FD1000-memory.dmp

      Filesize

      68KB