Analysis
- max time kernel
142s - max time network
144s - platform
windows10_x64 - resource
win10v200722 - submitted
26/09/2020, 08:08
General
- Target a2d724e306338577a5896594950d41a5.exe
- Size 335KB
- Sample200926-pvbxpxvrqa
- SHA256 8ceee34b010701c3745db2e9868c68902440d951d7c2dbe383ee2c25d5aa20dc
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d724e306338577a5896594950d41a5.exe"C:\Users\Admin\AppData\Local\Temp\a2d724e306338577a5896594950d41a5.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\vnjg\twuv.exeC:\ProgramData\vnjg\twuv.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3844-4-0x0000000004E3C000-0x0000000004E3E000-memory.dmp
memory/3844-5-0x0000000005360000-0x0000000005361000-memory.dmp
memory/4036-0-0x0000000004FB3000-0x0000000004FB4000-memory.dmp
memory/4036-1-0x00000000054E0000-0x00000000054E1000-memory.dmp