7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9

Analysis

max time kernel
137s
max time network
33s
platform
windows7_x64
resource
win7v200430
submitted
19/07/2020, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85d9770f45c0a07aff776b5117e8fc71.exe
Size 957KB
Sample200719-rns3zzsax2
SHA256 7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9
MD5 85d9770f45c0a07aff776b5117e8fc71
SHA1 fdafa1744005ba5766c230a44a53b570db5a9de4
SHA512 89e5812309b024acc6f256c62390b7ffd191ca7b4e266878aaff917f619069beb48169c907ba11b12d3e7f3001ffd8e6e5690bb120fca41a6248b985b56eb539
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 240	1032	85d9770f45c0a07aff776b5117e8fc71.exe	24
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1032 wrote to memory of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25
PID 1492 wrote to memory of 1760	1492	RegAsm.exe	28
PID 1492 wrote to memory of 1760	1492	RegAsm.exe	28
PID 1492 wrote to memory of 1760	1492	RegAsm.exe	28
PID 1492 wrote to memory of 1760	1492	RegAsm.exe	28
PID 1760 wrote to memory of 756	1760	cmd.exe	30
PID 1760 wrote to memory of 756	1760	cmd.exe	30
PID 1760 wrote to memory of 756	1760	cmd.exe	30
PID 1760 wrote to memory of 756	1760	cmd.exe	30
PID 1760 wrote to memory of 296	1760	cmd.exe	32
PID 1760 wrote to memory of 296	1760	cmd.exe	32
PID 1760 wrote to memory of 296	1760	cmd.exe	32
PID 1760 wrote to memory of 296	1760	cmd.exe	32

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	85d9770f45c0a07aff776b5117e8fc71.exe
Token: SeDebugPrivilege	1492	RegAsm.exe
Token: SeDebugPrivilege	756	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1032	85d9770f45c0a07aff776b5117e8fc71.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 1492	1032	85d9770f45c0a07aff776b5117e8fc71.exe	25

Kills process with taskkill 1 IoCs

evasion

pid	Process
756	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\85d9770f45c0a07aff776b5117e8fc71.exe
"C:\Users\Admin\AppData\Local\Temp\85d9770f45c0a07aff776b5117e8fc71.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 1492 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1492
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Kills process with taskkill
      PID:756
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-0-0x0000000000D40000-0x0000000000E0B000-memory.dmp

Download

memory/1032-1-0x0000000000F60000-0x0000000000F71000-memory.dmp

Download

memory/1032-2-0x0000000002AD0000-0x0000000002AE1000-memory.dmp

Download

memory/1032-3-0x0000000005410020-0x00000000054CD620-disk.dmp

Download

memory/1492-6-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1492-8-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1492-9-0x0000000000400000-0x000000000042C000-memory.dmp

Download