Analysis
- max time kernel
113s - max time network
122s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 13:40
General
- Target syslog.exe
- Size 5.2MB
- Sample200624-q5a112sten
- SHA256 9cc659b2ca813ac76fd302254522e11352627942aa96a256da9f82ea269e6d94
Score
7/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 2 IoCs
- Loads dropped DLL 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\syslog.exe"C:\Users\Admin\AppData\Local\Temp\syslog.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\syslog.exe"C:\Users\Admin\AppData\Local\Temp\syslog.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/336-16-0x000001C9071E0000-0x000001C9071E1000-memory.dmp
memory/336-17-0x000001C9079E0000-0x000001C9079E1000-memory.dmp
memory/336-18-0x000001C9071E0000-0x000001C9071E1000-memory.dmp
memory/336-81-0x000001C9071E0000-0x000001C9071E1000-memory.dmp