Overview

overview

10

Static

static

10

foo/0044d6...f7.exe

windows7_x64

1

foo/0044d6...f7.exe

windows10_x64

1

foo/034e4c...a9.exe

windows7_x64

4

foo/034e4c...a9.exe

windows10_x64

4

foo/035fa2...72.exe

windows7_x64

10

foo/035fa2...72.exe

windows10_x64

10

foo/04884a...1b.exe

windows7_x64

8

foo/04884a...1b.exe

windows10_x64

8

foo/06ed82...59.exe

windows7_x64

7

foo/06ed82...59.exe

windows10_x64

7

foo/07470b...68.exe

windows7_x64

8

foo/07470b...68.exe

windows10_x64

8

foo/078adb...c0.exe

windows7_x64

10

foo/078adb...c0.exe

windows10_x64

10

foo/09e5c8...b4.exe

windows7_x64

1

foo/09e5c8...b4.exe

windows10_x64

1

foo/0becfe...f4.exe

windows7_x64

10

foo/0becfe...f4.exe

windows10_x64

10

foo/1a78d3...a3.exe

windows7_x64

5

foo/1a78d3...a3.exe

windows10_x64

5

foo/1ffe82...a6.exe

windows7_x64

10

foo/1ffe82...a6.exe

windows10_x64

10

foo/255028...e1.dll

windows7_x64

1

foo/255028...e1.dll

windows10_x64

1

foo/27601d...cc.exe

windows7_x64

8

foo/27601d...cc.exe

windows10_x64

8

foo/27f911...49.exe

windows7_x64

10

foo/27f911...49.exe

windows10_x64

10

foo/28408c...c5.exe

windows7_x64

10

foo/28408c...c5.exe

windows10_x64

10

foo/296822...e4.dll

windows7_x64

3

foo/296822...e4.dll

windows10_x64

3

foo/2de7b8...a4.exe

windows7_x64

10

foo/2de7b8...a4.exe

windows10_x64

10

foo/2e00df...8b.exe

windows7_x64

9

foo/2e00df...8b.exe

windows10_x64

9

foo/2e90a1...22.exe

windows7_x64

6

foo/2e90a1...22.exe

windows10_x64

6

foo/2f215e...b0.dll

windows7_x64

10

foo/2f215e...b0.dll

windows10_x64

10

foo/30bc06...3e.exe

windows7_x64

10

foo/30bc06...3e.exe

windows10_x64

10

foo/312e67...f3.exe

windows7_x64

4

foo/312e67...f3.exe

windows10_x64

4

foo/383497...1b.exe

windows7_x64

10

foo/383497...1b.exe

windows10_x64

10

foo/39555e...ec.exe

windows7_x64

10

foo/39555e...ec.exe

windows10_x64

10

foo/39e531...04.exe

windows7_x64

10

foo/39e531...04.exe

windows10_x64

10

foo/3aba72...cd.exe

windows7_x64

1

foo/3aba72...cd.exe

windows10_x64

1

foo/406c9b...fe.exe

windows7_x64

10

foo/406c9b...fe.exe

windows10_x64

10

foo/457cfd...ca.exe

windows7_x64

7

foo/457cfd...ca.exe

windows10_x64

7

foo/4761e4...60.exe

windows7_x64

8

foo/4761e4...60.exe

windows10_x64

8

foo/487f1b...04.exe

windows7_x64

8

foo/487f1b...04.exe

windows10_x64

7

foo/4a74c9...cf.exe

windows7_x64

10

foo/4a74c9...cf.exe

windows10_x64

10

foo/4b2d78...4b.exe

windows7_x64

8

foo/4b2d78...4b.exe

windows10_x64

8

foo/4c49c2...ba.exe

windows7_x64

1

foo/4c49c2...ba.exe

windows10_x64

1

foo/4cfe8f...77.exe

windows7_x64

9

foo/4cfe8f...77.exe

windows10_x64

9

foo/4ea454...13.exe

windows7_x64

8

foo/4ea454...13.exe

windows10_x64

8

foo/52d6c5...7e.exe

windows7_x64

7

foo/52d6c5...7e.exe

windows10_x64

7

foo/55fc11...e0.exe

windows7_x64

foo/55fc11...e0.exe

windows10_x64

10

foo/59f0fb...06.exe

windows7_x64

1

foo/59f0fb...06.exe

windows10_x64

1

foo/5b1c0d...cb.exe

windows7_x64

1

foo/5b1c0d...cb.exe

windows10_x64

1

foo/5bc72a...ea.exe

windows7_x64

8

foo/5bc72a...ea.exe

windows10_x64

8

foo/5d3305...2a.exe

windows7_x64

7

foo/5d3305...2a.exe

windows10_x64

7

foo/5d9775...39.exe

windows7_x64

8

foo/5d9775...39.exe

windows10_x64

8

foo/60121e...3e.exe

windows7_x64

9

foo/60121e...3e.exe

windows10_x64

9

foo/62565a...fd.exe

windows7_x64

10

foo/62565a...fd.exe

windows10_x64

10

foo/62a3fd...64.exe

windows7_x64

8

foo/62a3fd...64.exe

windows10_x64

10

foo/63e9ce...d0.exe

windows7_x64

8

foo/63e9ce...d0.exe

windows10_x64

8

foo/6497ba...c5.exe

windows7_x64

10

foo/6497ba...c5.exe

windows10_x64

10

foo/698cc8...31.exe

windows7_x64

7

foo/698cc8...31.exe

windows10_x64

7

foo/6f2c5c...d5.exe

windows7_x64

7

foo/6f2c5c...d5.exe

windows10_x64

7

foo/798f5e...ba.exe

windows7_x64

10

foo/798f5e...ba.exe

windows10_x64

10

foo/7aec86...51.exe

windows7_x64

1

foo/7aec86...51.exe

windows10_x64

1

foo/84bf6e...64.exe

windows7_x64

8

foo/84bf6e...64.exe

windows10_x64

8

foo/907b7d...b3.exe

windows7_x64

8

foo/907b7d...b3.exe

windows10_x64

8

foo/928f1d...ee.exe

windows7_x64

1

foo/928f1d...ee.exe

windows10_x64

1

foo/9401b0...6c.exe

windows7_x64

1

foo/9401b0...6c.exe

windows10_x64

1

foo/97dd87...84.exe

windows7_x64

10

foo/97dd87...84.exe

windows10_x64

10

foo/9b8c48...a4.exe

windows7_x64

8

foo/9b8c48...a4.exe

windows10_x64

8

foo/9cde71...cd.exe

windows7_x64

6

foo/9cde71...cd.exe

windows10_x64

6

foo/9d3438...4b.exe

windows7_x64

8

foo/9d3438...4b.exe

windows10_x64

1

foo/9f8818...2d.exe

windows7_x64

8

foo/9f8818...2d.exe

windows10_x64

3

foo/a17bdc...cf.exe

windows7_x64

9

foo/a17bdc...cf.exe

windows10_x64

9

foo/a29811...46.exe

windows7_x64

10

foo/a29811...46.exe

windows10_x64

10

foo/aa3b51...52.exe

windows7_x64

10

foo/aa3b51...52.exe

windows10_x64

10

foo/acf0b7...c4.exe

windows7_x64

8

foo/acf0b7...c4.exe

windows10_x64

8

foo/aeca5c...f7.exe

windows7_x64

1

foo/aeca5c...f7.exe

windows10_x64

1

foo/b10714...f3.exe

windows7_x64

8

foo/b10714...f3.exe

windows10_x64

8

foo/b23652...9f.exe

windows7_x64

6

foo/b23652...9f.exe

windows10_x64

6

foo/b514b5...fc.exe

windows7_x64

1

foo/b514b5...fc.exe

windows10_x64

1

foo/b64196...23.exe

windows7_x64

7

foo/b64196...23.exe

windows10_x64

7

foo/b693df...60.exe

windows7_x64

7

foo/b693df...60.exe

windows10_x64

7

foo/b6e7c9...bc.exe

windows7_x64

10

foo/b6e7c9...bc.exe

windows10_x64

10

foo/b7d5f0...4a.exe

windows7_x64

10

foo/b7d5f0...4a.exe

windows10_x64

10

foo/ba2d46...29.exe

windows7_x64

1

foo/ba2d46...29.exe

windows10_x64

1

foo/bad78e...e5.exe

windows7_x64

9

foo/bad78e...e5.exe

windows10_x64

9

foo/bc6536...b9.exe

windows7_x64

10

foo/bc6536...b9.exe

windows10_x64

10

foo/be85e0...2c.exe

windows7_x64

1

foo/be85e0...2c.exe

windows10_x64

1

foo/c914b1...ee.exe

windows7_x64

3

foo/c914b1...ee.exe

windows10_x64

3

foo/c944ea...cc.exe

windows7_x64

8

foo/c944ea...cc.exe

windows10_x64

8

foo/cad363...8b.exe

windows7_x64

6

foo/cad363...8b.exe

windows10_x64

6

foo/cd89b6...df.exe

windows7_x64

8

foo/cd89b6...df.exe

windows10_x64

8

foo/d81e76...c4.exe

windows7_x64

10

foo/d81e76...c4.exe

windows10_x64

10

foo/d86d2c...08.exe

windows7_x64

10

foo/d86d2c...08.exe

windows10_x64

10

foo/d8e37d...98.exe

windows7_x64

9

foo/d8e37d...98.exe

windows10_x64

9

foo/dea515...e1.exe

windows7_x64

10

foo/dea515...e1.exe

windows10_x64

6

foo/dfcc55...b8.exe

windows7_x64

7

foo/dfcc55...b8.exe

windows10_x64

7

foo/e03bd4...fe.exe

windows7_x64

8

foo/e03bd4...fe.exe

windows10_x64

8

foo/e16ec7...2d.exe

windows7_x64

8

foo/e16ec7...2d.exe

windows10_x64

8

foo/e61c0e...0e.exe

windows7_x64

7

foo/e61c0e...0e.exe

windows10_x64

7

foo/e78fad...51.exe

windows7_x64

8

foo/e78fad...51.exe

windows10_x64

8

foo/e7ad45...88.exe

windows7_x64

3

foo/e7ad45...88.exe

windows10_x64

3

foo/e95678...8f.exe

windows7_x64

1

foo/e95678...8f.exe

windows10_x64

1

foo/edf723...ee.dll

windows7_x64

1

foo/edf723...ee.dll

windows10_x64

1

foo/f2366f...f5.exe

windows7_x64

1

foo/f2366f...f5.exe

windows10_x64

1

foo/f645a9...1f.exe

windows7_x64

1

foo/f645a9...1f.exe

windows10_x64

1

foo/f65e75...56.exe

windows7_x64

1

foo/f65e75...56.exe

windows10_x64

1

foo/f66028...2b.exe

windows7_x64

8

foo/f66028...2b.exe

windows10_x64

8

foo/f6c1c7...89.exe

windows7_x64

10

foo/f6c1c7...89.exe

windows10_x64

10

foo/fbab90...7c.exe

windows7_x64

7

foo/fbab90...7c.exe

windows10_x64

7

foo/fcdc00...b3.exe

windows7_x64

8

foo/fcdc00...b3.exe

windows10_x64

8

foo/fffb61...ba.exe

windows7_x64

1

foo/fffb61...ba.exe

windows10_x64

1

Analysis

  • max time kernel
    153s
  • max time network
    98s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    11-08-2020 12:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    foo/1a78d313f2891bd468f78694814a28a3.exe

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 46 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Drops file in Windows directory 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\foo\1a78d313f2891bd468f78694814a28a3.exe
    "C:\Users\Admin\AppData\Local\Temp\foo\1a78d313f2891bd468f78694814a28a3.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3964-0-0x000001EC07FC0000-0x000001EC07FC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-2-0x00007FFF8CC70000-0x00007FFF8D65C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/3964-3-0x00007FF7DD220000-0x00007FF7DD222000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3964-5-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-6-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-7-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-8-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-9-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-10-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-11-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-12-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-13-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-14-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-15-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-16-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-17-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-18-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-19-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-20-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-21-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-22-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-23-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-24-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-25-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-26-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-27-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-28-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-29-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-30-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-31-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-32-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-33-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-34-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-35-0x0000000000A20000-0x0000000000A22000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3964-36-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-37-0x000001EC220C0000-0x000001EC220C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-38-0x000001EC221A0000-0x000001EC221A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-39-0x000001EC078B0000-0x000001EC078B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-40-0x000001EC08200000-0x000001EC08201000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-41-0x0000000000A30000-0x0000000000A32000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3964-42-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3964-43-0x000001EC225B0000-0x000001EC225B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-44-0x000001EC226D0000-0x000001EC226E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3964-48-0x000001EC226F0000-0x000001EC227F0000-memory.dmp

    Filesize

    1024KB

    Download