cdebb39b2a4f203a8c0be1ce06cbeed1396321d8871d3cc46d4c6639ae7d25a2 | Triage

Analysis

max time kernel
128s
max time network
97s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 12:51

Sharing

Report Analysis Logs

General

Target

Remit.Advice.exe
Size

406KB
MD5

eee0330f850eeb8d07aeb8e180afc051
SHA1

0a64e31ae85096b82c8d36b497eb1fab9bc8fc10
SHA256

cdebb39b2a4f203a8c0be1ce06cbeed1396321d8871d3cc46d4c6639ae7d25a2
SHA512

66a0fc4a1eefb21a31297a4350084b6a8ce4b25af3bbf224c9b387ed7736c7f5465ca97c40454f6c5506d4f3d390f3271fb709de1a3094170aa057004d597fda

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	1484	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2884	WerFault.exe
Token: SeBackupPrivilege	2884	WerFault.exe
Token: SeDebugPrivilege	2884	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe
2884	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Remit.Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Remit.Advice.exe"
1⤵
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-0-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/2884-1-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/2884-3-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download