Overview

overview

10

Static

static

grabbot_0....ir.exe

windows7_x64

8

grabbot_0....ir.exe

windows10_x64

10

Analysis

  • max time kernel
    116s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    19-07-2020 17:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    grabbot_0.1.4.0.vir.exe

  • Size

    284KB

  • MD5

    3c3ebe8014d0c9b63e752267a58f7350

  • SHA1

    390e98beff93c5cdc28664c6f7bc906b9b1d851f

  • SHA256

    2f3709579bd5f0c039eed9e4a849ae46b286cc779cecad78910aaffae51b4278

  • SHA512

    b99064660e8a85e0a247eaac8a8f975849b01437de06e82fefb14d6618af4742da42d29e5cbf006d1c3cc31fafb99c34dcf04dd01aa420dbfa93c76d9a695bcc

Score
10/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3012
      • C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.4.0.vir.exe
        "C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.4.0.vir.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetThreadContext
        PID:2016
        • C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.4.0.vir.exe
          C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.4.0.vir.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • Suspicious use of AdjustPrivilegeToken
          PID:2068
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 552
            4⤵
            • Program crash
            • Suspicious use of NtCreateProcessExOtherParentProcess
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2272

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2068-1-0x0000000000404760-mapping.dmp
      Download
    • memory/2068-0-0x0000000000400000-0x0000000000435000-memory.dmp
      Filesize

      212KB

      Download
    • memory/2068-2-0x0000000000400000-0x0000000000435000-memory.dmp
      Filesize

      212KB

      Download
    • memory/2068-4-0x0000000000404760-mapping.dmp
      Download
    • memory/2068-5-0x0000000000404760-mapping.dmp
      Download
    • memory/2068-6-0x0000000000404760-mapping.dmp
      Download
    • memory/2272-3-0x0000000004240000-0x0000000004241000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2272-7-0x00000000048F0000-0x00000000048F1000-memory.dmp
      Filesize

      4KB

      Download