Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 06:24
Static task
static1
Behavioral task
behavioral1
Sample
TwitchTool.bin.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TwitchTool.bin.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
TwitchTool.bin.exe
-
Size
601KB
-
MD5
9f7767588a1b1437461fffa851c96d3c
-
SHA1
e43fb2d6cec21d2da1f5dd82a6c450dcd3e18fc0
-
SHA256
d3922882bfee49abb72584b9d5918f3787221fa40b7f552c98d7bc0e55833234
-
SHA512
40f7bb6399faec990c818bfdd9413121a630a14d927a0809e2e2c0e6620e7f5b4d4d65cb8e267d236fba90b7f2bc944dc3296138ef0747eab40e488eb3243e6e
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
TwitchTool.bin.exeWin32.exedescription pid process target process PID 2564 wrote to memory of 2236 2564 TwitchTool.bin.exe schtasks.exe PID 2564 wrote to memory of 2236 2564 TwitchTool.bin.exe schtasks.exe PID 2564 wrote to memory of 584 2564 TwitchTool.bin.exe Win32.exe PID 2564 wrote to memory of 584 2564 TwitchTool.bin.exe Win32.exe PID 584 wrote to memory of 860 584 Win32.exe schtasks.exe PID 584 wrote to memory of 860 584 Win32.exe schtasks.exe -
Executes dropped EXE 1 IoCs
Processes:
Win32.exepid process 584 Win32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Win32.exepid process 584 Win32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TwitchTool.bin.exeWin32.exedescription pid process Token: SeDebugPrivilege 2564 TwitchTool.bin.exe Token: SeDebugPrivilege 584 Win32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TwitchTool.bin.exe"C:\Users\Admin\AppData\Local\Temp\TwitchTool.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Win32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\TwitchTool.bin.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2236 -
C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
PID:584 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Win32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:860