Analysis
- max time kernel
145s - max time network
140s - platform
windows10_x64 - resource
win10v200722 - submitted
17/08/2020, 08:13
General
- Target inquiry Nasser Al Falahy.exe
- Size 1.0MB
- Sample200817-vtfejkmets
- SHA256 5a08d0f514ac2efd07cc045c1b896cf7c6426dd0013ad523a14bbdbce2b25edd
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NRQOUAsHhOY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B2F.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe'4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2056-146-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-86-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-13-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-280-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2056-16-0x0000000073490000-0x0000000073B7E000-memory.dmp
memory/2056-19-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-20-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-21-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-22-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-23-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-24-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-25-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-26-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-27-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-28-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-29-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-30-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-31-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-32-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-33-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-34-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-35-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-36-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-37-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-38-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-39-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-40-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-41-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-42-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-43-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-44-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-45-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-46-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-47-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-48-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-49-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-50-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-51-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-52-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-53-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-54-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-55-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-56-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-57-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-59-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-58-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-60-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-61-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-62-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-63-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-64-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-65-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-66-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-67-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-68-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-69-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-70-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-71-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-72-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-73-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-74-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-75-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-76-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-77-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-78-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-79-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-149-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-81-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-82-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-83-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-84-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-85-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-150-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-87-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-88-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-89-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-90-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-91-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-92-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-93-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-94-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-95-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-96-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-97-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-98-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-99-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-100-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-101-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-102-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-103-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-104-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-105-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-106-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-107-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-108-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-109-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-110-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-111-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-112-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-113-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-114-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-115-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-116-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-117-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-118-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-119-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-120-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-121-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-122-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-123-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-124-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-125-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-126-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-127-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-128-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-129-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-130-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-131-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-132-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-133-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-134-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-135-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-136-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-137-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-138-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-139-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-140-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-141-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-142-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-143-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-144-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-145-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-279-0x0000000005350000-0x000000000538E000-memory.dmp
memory/2056-147-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-148-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-80-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-276-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-168-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-152-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-153-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-154-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-155-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-156-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-157-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-158-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-159-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-160-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-161-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-162-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-163-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-164-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-165-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-166-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-167-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-151-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-169-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-170-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-171-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-172-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-173-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-174-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-175-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-176-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-177-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-178-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-179-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-180-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-181-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-182-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-183-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-184-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-185-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-186-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-187-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-188-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-189-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-190-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-191-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-192-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-193-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-194-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-195-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-196-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-197-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-198-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-199-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-200-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-201-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-202-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-203-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-204-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-205-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-206-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-207-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-208-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-209-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-210-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-211-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-212-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-213-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-214-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-215-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-216-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-217-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-218-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-219-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-220-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-221-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-222-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-223-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-224-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-225-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-226-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-227-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-228-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-229-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-230-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-231-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-232-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-233-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-234-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-235-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-236-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-237-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-238-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-239-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-240-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-241-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-242-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-243-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-244-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-245-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-246-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-247-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-248-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-249-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-250-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-251-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-252-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-253-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-254-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-255-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-256-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-257-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-258-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-259-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-260-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-261-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-262-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-263-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-264-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-265-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-266-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-267-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-268-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-269-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-271-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-270-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-272-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-273-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-274-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2056-275-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3956-1-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/3956-0-0x0000000073490000-0x0000000073B7E000-memory.dmp
memory/3956-5-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/3956-4-0x0000000005EB0000-0x0000000005EB1000-memory.dmp
memory/3956-3-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/3956-6-0x0000000005880000-0x0000000005881000-memory.dmp
memory/3956-7-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/3956-8-0x0000000005B50000-0x0000000005B53000-memory.dmp
memory/3956-9-0x00000000065B0000-0x0000000006699000-memory.dmp
memory/3956-10-0x00000000067B0000-0x000000000686D000-memory.dmp