Analysis
- max time kernel
143s - max time network
138s - platform
windows10_x64 - resource
win10v200722 - submitted
27/07/2020, 07:53
General
- Target PAYMEN..exe
- Size 642KB
- Sample200727-xr4tdr28te
- SHA256 464e2cdc647f312a60d4431fa0d4658a27916bb5fd3fc92986a4d5a03b8039dc
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMEN..exe"C:\Users\Admin\AppData\Local\Temp\PAYMEN..exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 6883⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2676-0-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/3876-23-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-27-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-4-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/3876-3-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/3876-13-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/3876-12-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-14-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-15-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-16-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-17-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-18-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-19-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-20-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-21-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-22-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-24-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-25-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-26-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-5-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/3876-28-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-29-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-30-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-31-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-32-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-33-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-34-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-35-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-36-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-37-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-38-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-39-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-40-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-42-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-41-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-43-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-44-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-45-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-46-0x0000000000990000-0x0000000000991000-memory.dmp
memory/3876-47-0x0000000000990000-0x0000000000991000-memory.dmp