Analysis
-
max time kernel
115s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 12:12
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
winlog.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
winlog.exe
-
Size
441KB
-
MD5
206fa6f9e31c508d79a4677d679730f2
-
SHA1
222ddef076c12e0a141c1f4dbf0190a9bab5b811
-
SHA256
c382d2d33c7036ac95058ef7ab3305b3234394428c28786d8c35f4a049047653
-
SHA512
b067802014dad290db64d00f2a900b57789c71b78755dd73a855a081625488640d1390b319f9d3e19f09a2ca0cb252e19e61c33a384f482ad567e0a6a5251e37
Score
7/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
winlog.exerundll32.exedescription pid process target process PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 1496 wrote to memory of 652 1496 winlog.exe rundll32.exe PID 652 wrote to memory of 792 652 rundll32.exe WerFault.exe PID 652 wrote to memory of 792 652 rundll32.exe WerFault.exe PID 652 wrote to memory of 792 652 rundll32.exe WerFault.exe PID 652 wrote to memory of 792 652 rundll32.exe WerFault.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 652 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 792 652 WerFault.exe rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 792 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 792 WerFault.exe 792 WerFault.exe 792 WerFault.exe 792 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Subclimax,Epimers2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 2283⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Archery
-
C:\Users\Admin\AppData\Local\Temp\Subclimax.DLL
-
\Users\Admin\AppData\Local\Temp\Subclimax.dll
-
memory/652-0-0x0000000000000000-mapping.dmp
-
memory/652-6-0x0000000000000000-mapping.dmp
-
memory/792-4-0x0000000000000000-mapping.dmp
-
memory/792-5-0x0000000001E60000-0x0000000001E71000-memory.dmpFilesize
68KB
-
memory/792-7-0x0000000002610000-0x0000000002621000-memory.dmpFilesize
68KB