Analysis
- max time kernel
126s - max time network
126s - platform
windows10_x64 - resource
win10 - submitted
07/08/2020, 13:28
General
- Target REVISED-OFFER 223234.exe
- Size 1.1MB
- Sample200807-nt2cczhels
- SHA256 fa473a9f7280e22e757799c9d18a21bded2f5500a47063e926105db33e77b4f8
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Suspicious use of SetThreadContext 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVISED-OFFER 223234.exe"C:\Users\Admin\AppData\Local\Temp\REVISED-OFFER 223234.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\REVISED-OFFER 223234.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\REVISED-OFFER 223234.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\REVISED-OFFER 223234.exe'4⤵
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3608-9-0x000000000A540000-0x000000000A5F3000-memory.dmp
memory/3608-5-0x0000000005370000-0x0000000005371000-memory.dmp
memory/3608-7-0x0000000007820000-0x0000000007821000-memory.dmp
memory/3608-8-0x0000000007D10000-0x0000000007DC6000-memory.dmp
memory/3608-0-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/3608-1-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/3608-3-0x00000000059F0000-0x00000000059F1000-memory.dmp
memory/3608-6-0x00000000055D0000-0x00000000055D8000-memory.dmp
memory/3608-4-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/3920-18-0x0000000005330000-0x00000000053A1000-memory.dmp
memory/3920-19-0x0000000005420000-0x0000000005421000-memory.dmp
memory/3920-13-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/3920-10-0x0000000000400000-0x00000000004B8000-memory.dmp