Overview

overview

6

Static

static

LC DRAFT C...es.exe

windows7_x64

6

LC DRAFT C...es.exe

windows10_x64

6

Analysis

  • max time kernel
    150s
  • max time network
    72s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    25/07/2020, 07:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LC DRAFT COPY_images.exe
  • Size 531KB
  • Sample200725-vxr83jzzte
  • SHA256 1a4dea5eadd7dd451ad9a13ba19fce11b26e33e0a730662fb39147ea7f0b94bd
  • MD5 SHA1 SHA512
Score
6/10
persistence

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 103 IoCs
  • Suspicious behavior: MapViewOfSection 17 IoCs
  • Suspicious use of SetThreadContext 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 11440 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
    "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:3908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1732
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Adds Run key to start application
        PID:3940
      • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
        "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:628
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:804
          • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
            "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1096
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              • Adds Run key to start application
              PID:4040
            • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
              "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3944
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:2692
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:2708
                  • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                    "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3176
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Adds Run key to start application
                      PID:3592
                    • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                      "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4004
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        7⤵
                          PID:812
                        • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                          "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                          7⤵
                          • Suspicious use of WriteProcessMemory
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3976
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            • Adds Run key to start application
                            PID:2632
                          • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                            "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                            8⤵
                            • Suspicious use of WriteProcessMemory
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3516
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              9⤵
                                PID:736
                              • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                9⤵
                                • Suspicious use of WriteProcessMemory
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:68
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  10⤵
                                    PID:3040
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    10⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Adds Run key to start application
                                    PID:3384
                                  • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                    "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                    10⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1100
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      11⤵
                                        PID:3888
                                      • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                        "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                        11⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1680
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          12⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Adds Run key to start application
                                          PID:3748
                                        • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                          "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                          12⤵
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4012
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            13⤵
                                              PID:812
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              13⤵
                                                PID:3172
                                              • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                                "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                                13⤵
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1172
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  14⤵
                                                    PID:2892
                                                  • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                                    14⤵
                                                      PID:3608

                          Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                memory/3940-0-0x0000000000400000-0x000000000044C000-memory.dmp
                                Download