85e8eb80abd37d60fe3c10fa22f9585ac1932b3a8079317f663b90191920b75b | Triage

Analysis

max time kernel
137s
max time network
66s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:25

Sharing

Report Analysis Logs

General

Target

citadel_1.3.5.1.vir.exe
Size

229KB
MD5

8fdf36fb7f4935a272f7e6898b70bdc9
SHA1

666cc7d3b58aba61a73c482605bf1f2a612bc7f7
SHA256

85e8eb80abd37d60fe3c10fa22f9585ac1932b3a8079317f663b90191920b75b
SHA512

69379bafcedcfee1a85dafbe72ae79448c9b985d31ab55420c32473f597c561d46f75ed4a3446adc5147312efe20fc9477c20a05093ee6750533bc6d06458769

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1012 2904 WerFault.exe citadel_1.3.5.1.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1012 WerFault.exe
Token: SeBackupPrivilege 1012 WerFault.exe
Token: SeDebugPrivilege 1012 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\citadel_1.3.5.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\citadel_1.3.5.1.vir.exe"
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 276
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-0-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download