46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a | Triage

Analysis

max time kernel
108s
max time network
99s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Report Analysis Logs

General

Target

foo/e16ec7bc29b68f66e90fdbfefe1d3a2d.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1084	e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp

Loads dropped DLL 4 IoCs

pid	Process
1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe
1084	e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp
1084	e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp
1084	e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1084	e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24
PID 1124 wrote to memory of 1084	1124	e16ec7bc29b68f66e90fdbfefe1d3a2d.exe	24

C:\Users\Admin\AppData\Local\Temp\foo\e16ec7bc29b68f66e90fdbfefe1d3a2d.exe
"C:\Users\Admin\AppData\Local\Temp\foo\e16ec7bc29b68f66e90fdbfefe1d3a2d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\is-897VM.tmp\e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-897VM.tmp\e16ec7bc29b68f66e90fdbfefe1d3a2d.tmp" /SL5="$50134,383909,132096,C:\Users\Admin\AppData\Local\Temp\foo\e16ec7bc29b68f66e90fdbfefe1d3a2d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads