46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
49s
max time network
45s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/0044d66e4abf7c4af6b5d207065320f7.exe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0044d66e4abf7c4af6b5d207065320f7.exe

pid process

852 0044d66e4abf7c4af6b5d207065320f7.exe
852 0044d66e4abf7c4af6b5d207065320f7.exe

pid	process
852	0044d66e4abf7c4af6b5d207065320f7.exe
852	0044d66e4abf7c4af6b5d207065320f7.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

0044d66e4abf7c4af6b5d207065320f7.exe

description	pid	process
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

0044d66e4abf7c4af6b5d207065320f7.exe

description	pid	process	target process
PID 852 wrote to memory of 1308	852	0044d66e4abf7c4af6b5d207065320f7.exe	Explorer.EXE
PID 852 wrote to memory of 260	852	0044d66e4abf7c4af6b5d207065320f7.exe	smss.exe
PID 852 wrote to memory of 332	852	0044d66e4abf7c4af6b5d207065320f7.exe	csrss.exe
PID 852 wrote to memory of 368	852	0044d66e4abf7c4af6b5d207065320f7.exe	wininit.exe
PID 852 wrote to memory of 380	852	0044d66e4abf7c4af6b5d207065320f7.exe	csrss.exe
PID 852 wrote to memory of 416	852	0044d66e4abf7c4af6b5d207065320f7.exe	winlogon.exe
PID 852 wrote to memory of 460	852	0044d66e4abf7c4af6b5d207065320f7.exe	services.exe
PID 852 wrote to memory of 476	852	0044d66e4abf7c4af6b5d207065320f7.exe	lsass.exe
PID 852 wrote to memory of 484	852	0044d66e4abf7c4af6b5d207065320f7.exe	lsm.exe
PID 852 wrote to memory of 600	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 680	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 756	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 812	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 840	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 872	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 284	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 272	852	0044d66e4abf7c4af6b5d207065320f7.exe	svchost.exe
PID 852 wrote to memory of 1148	852	0044d66e4abf7c4af6b5d207065320f7.exe	taskhost.exe
PID 852 wrote to memory of 1260	852	0044d66e4abf7c4af6b5d207065320f7.exe	Dwm.exe
PID 852 wrote to memory of 1308	852	0044d66e4abf7c4af6b5d207065320f7.exe	Explorer.EXE

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:812

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:272

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1148

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:476

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\foo\0044d66e4abf7c4af6b5d207065320f7.exe
"C:\Users\Admin\AppData\Local\Temp\foo\0044d66e4abf7c4af6b5d207065320f7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-0-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download