Analysis
- max time kernel
13s - max time network
64s - platform
windows10_x64 - resource
win10 - submitted
05/10/2020, 11:12
General
- Target 9c5b860421d72247a177f8f8abc7a829.exe
- Size 1019KB
- Sample201005-8cw921657a
- SHA256 b3f2d07e97cfe28deee3a65b8541c48f96f022b52db515b06c635f3b9fcc35ef
Malware Config
Signatures
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c5b860421d72247a177f8f8abc7a829.exe"C:\Users\Admin\AppData\Local\Temp\9c5b860421d72247a177f8f8abc7a829.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9c5b860421d72247a177f8f8abc7a829.exe"C:\Users\Admin\AppData\Local\Temp\9c5b860421d72247a177f8f8abc7a829.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\9c5b860421d72247a177f8f8abc7a829.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/352-12-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/352-1-0x0000000000400000-0x0000000000521000-memory.dmp
memory/352-3-0x0000000000400000-0x0000000000521000-memory.dmp
memory/352-4-0x0000000000400000-0x0000000000521000-memory.dmp
memory/352-5-0x00000000022B0000-0x0000000002338000-memory.dmp
memory/352-6-0x00000000006A2000-0x00000000006A3000-memory.dmp
memory/352-7-0x0000000072C60000-0x000000007334E000-memory.dmp
memory/352-10-0x0000000002800000-0x0000000002801000-memory.dmp
memory/352-11-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/1640-14-0x00000000731D0000-0x00000000738BE000-memory.dmp
memory/1640-20-0x0000000007940000-0x0000000007941000-memory.dmp
memory/1640-27-0x0000000006B90000-0x0000000006B91000-memory.dmp
memory/1640-15-0x0000000004500000-0x0000000004501000-memory.dmp
memory/1640-16-0x00000000070C0000-0x00000000070C1000-memory.dmp
memory/1640-17-0x0000000006F70000-0x0000000006F71000-memory.dmp
memory/1640-18-0x0000000007010000-0x0000000007011000-memory.dmp
memory/1640-21-0x0000000007740000-0x0000000007741000-memory.dmp
memory/1640-22-0x0000000008230000-0x0000000008231000-memory.dmp
memory/1640-23-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
memory/1640-24-0x0000000009780000-0x0000000009781000-memory.dmp
memory/1640-25-0x0000000008D40000-0x0000000008D41000-memory.dmp
memory/1640-26-0x0000000009100000-0x0000000009101000-memory.dmp
memory/3536-0-0x0000000000400000-0x0000000000505000-memory.dmp