00c3032bacb17b0624f5f550e22169259a9f4c1212845cb202be466fae55aaf7

Analysis

max time kernel
67s
max time network
74s
platform
windows10_x64
resource
win10
submitted
12/08/2020, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A7q1YQHrbk5bauQ.exe
Size 1004KB
Sample200812-llxnwab5aa
SHA256 00c3032bacb17b0624f5f550e22169259a9f4c1212845cb202be466fae55aaf7
MD5 33f3f30c448557a14aee7fefbd7af376
SHA1 c7747965cb2a4b86c163db81b98b96d389c09b07
SHA512 6307635f1b7ba17aae9994d52bd2f1538c010f2c7d4b06e052a5f42d1402feda9b19ebda5d89e46b511ff490dca362dc46d419e6b1add0f6f9ec514479c0d0ae
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3908	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 3000	3068	A7q1YQHrbk5bauQ.exe	68

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3068	A7q1YQHrbk5bauQ.exe
3068	A7q1YQHrbk5bauQ.exe
3068	A7q1YQHrbk5bauQ.exe
3068	A7q1YQHrbk5bauQ.exe
3068	A7q1YQHrbk5bauQ.exe
3000	A7q1YQHrbk5bauQ.exe
3000	A7q1YQHrbk5bauQ.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	A7q1YQHrbk5bauQ.exe
Token: SeDebugPrivilege	3000	A7q1YQHrbk5bauQ.exe
Token: SeDebugPrivilege	3908	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3520	3068	A7q1YQHrbk5bauQ.exe	67
PID 3068 wrote to memory of 3520	3068	A7q1YQHrbk5bauQ.exe	67
PID 3068 wrote to memory of 3520	3068	A7q1YQHrbk5bauQ.exe	67
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3068 wrote to memory of 3000	3068	A7q1YQHrbk5bauQ.exe	68
PID 3000 wrote to memory of 2916	3000	A7q1YQHrbk5bauQ.exe	70
PID 3000 wrote to memory of 2916	3000	A7q1YQHrbk5bauQ.exe	70
PID 3000 wrote to memory of 2916	3000	A7q1YQHrbk5bauQ.exe	70
PID 2916 wrote to memory of 3908	2916	cmd.exe	72
PID 2916 wrote to memory of 3908	2916	cmd.exe	72
PID 2916 wrote to memory of 3908	2916	cmd.exe	72

C:\Users\Admin\AppData\Local\Temp\A7q1YQHrbk5bauQ.exe
"C:\Users\Admin\AppData\Local\Temp\A7q1YQHrbk5bauQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\A7q1YQHrbk5bauQ.exe
  "{path}"
  2⤵
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\A7q1YQHrbk5bauQ.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\A7q1YQHrbk5bauQ.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\A7q1YQHrbk5bauQ.exe'
      4⤵
      Deletes itself
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-10-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/3000-19-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/3000-18-0x0000000005520000-0x0000000005591000-memory.dmp

Download

memory/3000-13-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/3068-8-0x000000000A0C0000-0x000000000A173000-memory.dmp

Download

memory/3068-9-0x000000000D5A0000-0x000000000D5A1000-memory.dmp

Download

memory/3068-0-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/3068-7-0x00000000078B0000-0x0000000007954000-memory.dmp

Download

memory/3068-6-0x00000000054D0000-0x00000000054D8000-memory.dmp

Download

memory/3068-5-0x0000000005080000-0x0000000005081000-memory.dmp

Download

memory/3068-4-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/3068-3-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/3068-1-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/3908-24-0x0000000074000000-0x00000000746EE000-memory.dmp

Download

memory/3908-30-0x0000000007570000-0x0000000007571000-memory.dmp

Download

memory/3908-25-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/3908-26-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Download

memory/3908-27-0x0000000006B80000-0x0000000006B81000-memory.dmp

Download

memory/3908-28-0x0000000006C30000-0x0000000006C31000-memory.dmp

Download

memory/3908-31-0x00000000073E0000-0x00000000073E1000-memory.dmp

Download

memory/3908-32-0x0000000007C70000-0x0000000007C71000-memory.dmp

Download

memory/3908-33-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Download

memory/3908-34-0x00000000093A0000-0x00000000093A1000-memory.dmp

Download

memory/3908-35-0x0000000008940000-0x0000000008941000-memory.dmp

Download

memory/3908-36-0x0000000008D20000-0x0000000008D21000-memory.dmp

Download

memory/3908-37-0x00000000067C0000-0x00000000067C1000-memory.dmp

Download