Analysis
- max time kernel
147s - max time network
151s - platform
windows7_x64 - resource
win7 - submitted
09/07/2020, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
ZgPNRmA9FUAPwwl.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ZgPNRmA9FUAPwwl.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target ZgPNRmA9FUAPwwl.exe
- Size 568KB
- Sample200709-gb43ffarkj
- SHA256 5523b6368db651832484529a46f8c4ce6661b4770e10081937b4014c97c2197a
- MD5 605e2e137b27ca373e5768af5258559d
- SHA1 6e393919835cb22412c61194ce4915907b41ec35
- SHA512 0207b0410b93731aff0665cab42a7d493e79c3d111fe8b229190ace10da613879426d1e2d9c4778073e379cdfb610212bc2d14a65b51042e18929c364b155699
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1044 1508 ZgPNRmA9FUAPwwl.exe 24 PID 1508 wrote to memory of 1044 1508 ZgPNRmA9FUAPwwl.exe 24 PID 1508 wrote to memory of 1044 1508 ZgPNRmA9FUAPwwl.exe 24 PID 1508 wrote to memory of 1044 1508 ZgPNRmA9FUAPwwl.exe 24 PID 1508 wrote to memory of 1060 1508 ZgPNRmA9FUAPwwl.exe 25 PID 1508 wrote to memory of 1060 1508 ZgPNRmA9FUAPwwl.exe 25 PID 1508 wrote to memory of 1060 1508 ZgPNRmA9FUAPwwl.exe 25 PID 1508 wrote to memory of 1060 1508 ZgPNRmA9FUAPwwl.exe 25 PID 1508 wrote to memory of 1132 1508 ZgPNRmA9FUAPwwl.exe 26 PID 1508 wrote to memory of 1132 1508 ZgPNRmA9FUAPwwl.exe 26 PID 1508 wrote to memory of 1132 1508 ZgPNRmA9FUAPwwl.exe 26 PID 1508 wrote to memory of 1132 1508 ZgPNRmA9FUAPwwl.exe 26 PID 1508 wrote to memory of 1656 1508 ZgPNRmA9FUAPwwl.exe 27 PID 1508 wrote to memory of 1656 1508 ZgPNRmA9FUAPwwl.exe 27 PID 1508 wrote to memory of 1656 1508 ZgPNRmA9FUAPwwl.exe 27 PID 1508 wrote to memory of 1656 1508 ZgPNRmA9FUAPwwl.exe 27 PID 1508 wrote to memory of 1120 1508 ZgPNRmA9FUAPwwl.exe 28 PID 1508 wrote to memory of 1120 1508 ZgPNRmA9FUAPwwl.exe 28 PID 1508 wrote to memory of 1120 1508 ZgPNRmA9FUAPwwl.exe 28 PID 1508 wrote to memory of 1120 1508 ZgPNRmA9FUAPwwl.exe 28 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1508 ZgPNRmA9FUAPwwl.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1508 ZgPNRmA9FUAPwwl.exe 1508 ZgPNRmA9FUAPwwl.exe 1508 ZgPNRmA9FUAPwwl.exe 1508 ZgPNRmA9FUAPwwl.exe 1508 ZgPNRmA9FUAPwwl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"{path}"2⤵PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"{path}"2⤵PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"{path}"2⤵PID:1132
-
-
C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"{path}"2⤵PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"{path}"2⤵PID:1120
-