ba17f2ed642b9376a974263ac207dc55385c8d09119c89c5b1afb3b20215705a | Triage

Analysis

max time kernel
127s
max time network
128s
platform
windows10_x64
resource
win10
submitted
19-07-2020 16:46

Sharing

Report Analysis Logs

General

Target

citadel_1.1.5.1.vir.exe
Size

219KB
MD5

6842dfc607a5d22511b0b37025092976
SHA1

1f90a17cd0e8c5b33d37c4f1d52e6fb490bbb888
SHA256

ba17f2ed642b9376a974263ac207dc55385c8d09119c89c5b1afb3b20215705a
SHA512

af7c5ba3c4128fb07f7d4ebce38e1f3a38cfc8a517ab32a0b4488cc63df366011129fdcc9610d110c9d5b8473534e201122af7b02d813d499d089fd3731d8633

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3832 3404 WerFault.exe citadel_1.1.5.1.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3832 WerFault.exe
Token: SeBackupPrivilege 3832 WerFault.exe
Token: SeDebugPrivilege 3832 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\citadel_1.1.5.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\citadel_1.1.5.1.vir.exe"
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 456
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3832-0-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3832-1-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download