Analysis
-
max time kernel
6s -
max time network
11s -
platform
windows7_x64 -
resource
win7 -
submitted
28-08-2020 17:46
General
-
Target
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.bin.exe
-
Size
12.6MB
-
MD5
d427390e9fad598ec3288c9275c84628
-
SHA1
7b88e1eaa07151fc0d7639574fc7f40fa5be8aa3
-
SHA256
4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6
-
SHA512
83ecc48386999ec6d05999d88e9a81eae5267ea807441727cd60d44f17ead8a0ca6e8a0ffa7d5e4e9fc800d858fb2ee824815abe4299e0ec85639384b75324a8
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 32 IoCs
-
JavaScript code in executable 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.bin.exe"C:\Users\Admin\AppData\Local\Temp\4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.bin.exe"C:\Users\Admin\AppData\Local\Temp\4b76ad80e9ce4c503bde0e476a88447426fc38315d440d22926627295e1b0ec6.bin.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_Salsa20.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_cbc.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_cfb.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ctr.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ecb.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ocb.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ofb.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_BLAKE2s.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_MD5.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_SHA1.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_SHA256.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_ghash_portable.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Math\_modexp.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Protocol\_scrypt.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Util\_cpuid_c.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Util\_strxor.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\VCRUNTIME140.dll
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_bz2.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_cffi_backend.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_ctypes.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_hashlib.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_lzma.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_queue.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_socket.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\_ssl.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\base_library.zip
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\certifi\cacert.pem
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\cryptography\hazmat\bindings\_padding.cp37-win_amd64.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\libcrypto-1_1.dll
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\libssl-1_1.dll
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\pyexpat.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\python37.dll
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\select.pyd
-
C:\Users\Admin\AppData\Local\Temp\_MEI16842\unicodedata.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_Salsa20.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_cbc.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_cfb.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ctr.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ecb.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ocb.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Cipher\_raw_ofb.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_BLAKE2s.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_MD5.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_SHA1.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_SHA256.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Hash\_ghash_portable.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Math\_modexp.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Protocol\_scrypt.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Util\_cpuid_c.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\Cryptodome\Util\_strxor.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\VCRUNTIME140.dll
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_bz2.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_cffi_backend.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_ctypes.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_hashlib.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_lzma.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_queue.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_socket.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\_ssl.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\cryptography\hazmat\bindings\_padding.cp37-win_amd64.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\libcrypto-1_1.dll
-
\Users\Admin\AppData\Local\Temp\_MEI16842\libssl-1_1.dll
-
\Users\Admin\AppData\Local\Temp\_MEI16842\pyexpat.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\python37.dll
-
\Users\Admin\AppData\Local\Temp\_MEI16842\select.pyd
-
\Users\Admin\AppData\Local\Temp\_MEI16842\unicodedata.pyd
-
memory/1940-0-0x0000000000000000-mapping.dmp