3a27b002eab25417e6ef4cdeb35edd40755a0a20f6c701842f10bfa9448e5c89 | Triage

Resubmissions

02-10-2020 21:14

201002-pjxdl9y6a6 10

01-10-2020 20:51

201001-e45lwcxsnn 10

01-10-2020 20:51

201001-fhxddb9gwe 10

01-10-2020 20:51

201001-ts8hns28ea 10

01-10-2020 20:51

201001-v1kt3kgljx 10

01-10-2020 20:51

201001-d2fbtjzv4s 10

01-10-2020 20:51

201001-cgj9prs442 10

01-10-2020 20:49

201001-t1jnpvwcgx 10

Analysis

max time kernel
24s
max time network
165s
platform
windows10_x64
resource
win10v200722
submitted
01-10-2020 20:51

Sharing

Report Analysis Logs

General

Target

201001-nyhbt4p25j_pw_infected/Keygen — копия (110) — копия.exe
Size

849KB
MD5

dbde61502c5c0e17ebc6919f361c32b9
SHA1

189749cf0b66a9f560b68861f98c22cdbcafc566
SHA256

88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
SHA512

d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Keygen.exe

pid process

3992 Keygen.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Keygen — копия (110) — копия.execmd.exe

description	pid	process	target process
PID 1060 wrote to memory of 3876	1060	Keygen — копия (110) — копия.exe	cmd.exe
PID 1060 wrote to memory of 3876	1060	Keygen — копия (110) — копия.exe	cmd.exe
PID 1060 wrote to memory of 3876	1060	Keygen — копия (110) — копия.exe	cmd.exe
PID 3876 wrote to memory of 3992	3876	cmd.exe	Keygen.exe
PID 3876 wrote to memory of 3992	3876	cmd.exe	Keygen.exe
PID 3876 wrote to memory of 3992	3876	cmd.exe	Keygen.exe

C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (110) — копия.exe
"C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (110) — копия.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\20D7.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (110) — ?????.exe""
2⤵
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\20D7.tmp\Keygen.exe
Keygen.exe
3⤵
- Executes dropped EXE
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20D7.tmp\Keygen.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\20D7.tmp\start.bat

Download Submit
memory/3876-0-0x0000000000000000-mapping.dmp

Download
memory/3992-2-0x0000000000000000-mapping.dmp

Download
memory/3992-3-0x0000000000000000-mapping.dmp

Download