cd09ee5a8782f78da8388d9d5f0b7322c43ee1cf55235837d4925d4ef1a7233d | Triage™

Analysis

max time kernel
47s
max time network
17s
platform
windows7_x64
resource
win7v200722
submitted
06/10/2020, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IOqMbSUfmDUcDz1.exe
Size 685KB
Sample201006-4jlx8dvb66
SHA256 cd09ee5a8782f78da8388d9d5f0b7322c43ee1cf55235837d4925d4ef1a7233d
MD5 c388e08b46d14dc64c5cabbe2fa215da
SHA1 8c33301f24c58c84063950c95e0521d6a323bd61
SHA512 0be9a5cb5b25d2a41acdcdd5fc58b35f618b7b06fd853e524b72313dd4c68345b2acea8e2c7cde2de8c8cc14f03a6e2f7db3a2f16c97884772b8be161dbe1c94
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	IOqMbSUfmDUcDz1.exe
392	IOqMbSUfmDUcDz1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	IOqMbSUfmDUcDz1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1616	392	IOqMbSUfmDUcDz1.exe	28
PID 392 wrote to memory of 1616	392	IOqMbSUfmDUcDz1.exe	28
PID 392 wrote to memory of 1616	392	IOqMbSUfmDUcDz1.exe	28
PID 392 wrote to memory of 1616	392	IOqMbSUfmDUcDz1.exe	28

C:\Users\Admin\AppData\Local\Temp\IOqMbSUfmDUcDz1.exe
"C:\Users\Admin\AppData\Local\Temp\IOqMbSUfmDUcDz1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 32356
  2⤵
  PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-2-0x0000000002090000-0x00000000020A1000-memory.dmp

Download