c6117524f5e25ef7de2eaa1e4693be4f0ebdc1548b3a8b170f96c4b1aeeb57c2 | Triage™

Analysis

max time kernel
116s
max time network
118s
platform
windows10_x64
resource
win10
submitted
17/07/2020, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ekstre.exe
Size 1.2MB
Sample200717-wm4qbllxes
SHA256 c6117524f5e25ef7de2eaa1e4693be4f0ebdc1548b3a8b170f96c4b1aeeb57c2
MD5 938dcd65814e49ccb1a8cfa5100923f7
SHA1 31b2fa63b6d1ed18267eba342e37f41830ac9337
SHA512 9337a6dbe2789a7639e7ba942115e357ecec430af9935d9df469ae0f7c24ba508fe23c0cac4111d5968f31f0a2b9d1c9867e3a512ecaddaddc255c496acb2a25
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	ekstre.exe
Token: SeRestorePrivilege	3948	WerFault.exe
Token: SeBackupPrivilege	3948	WerFault.exe
Token: SeDebugPrivilege	3948	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3588	ekstre.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	3588	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\ekstre.exe
"C:\Users\Admin\AppData\Local\Temp\ekstre.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1124
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3948-0-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/3948-1-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/3948-3-0x00000000056C0000-0x00000000056C1000-memory.dmp

Download