Analysis
-
max time kernel
122s -
max time network
115s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
27-02-2020 14:25
General
-
Target
out.exe
-
Size
439KB
-
MD5
dc47c83aa99bb69fd38e73b3554afddb
-
SHA1
3a6db3a80fdcd23ecde4b07404496cf6dcc481b0
-
SHA256
3e43cb34fdc8fc2ba11d51b1c157a76296e34c2ad541f60cc9d4459720b3893d
-
SHA512
b509e796f4183f730a74656268890ecefc6d7b554137fc9632225666616a8ba566a680ce0295aad32ca9039195c62e1388fba4ea9de2efcb95bfd41e55034773
Score
10/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 70 IoCs
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
Program crash 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7162⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8282⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 9002⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7242⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 11842⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB