Overview

overview

8

Static

static

Client-built.bin.exe

windows7_x64

8

Client-built.bin.exe

windows10_x64

8

Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    07/07/2020, 06:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Client-built.bin.exe
  • Size 601KB
  • Sample200707-9vrfszp2d6
  • SHA256 9760105f3177384c19086dee036cdc67916d744f4a1e7064ecfd906e252dba69
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.bin.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:792
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Win32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.bin.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:2296
    • C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3740
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Win32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:996

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads