9afa65760fd44752efe5e36713bec2ee0ce730a53896e1182bd8ff0737efa2c1 | Triage™

Analysis

max time kernel
53s
max time network
19s
platform
windows7_x64
resource
win7v200722
submitted
06/10/2020, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
928311 RFQ for Ecc. Reducer.exe
Size 613KB
Sample201006-v2dfykfh6e
SHA256 9afa65760fd44752efe5e36713bec2ee0ce730a53896e1182bd8ff0737efa2c1
MD5 4bfc368ade655d6ff303c81a9c5e7e57
SHA1 74cd018e5fef4b64854dc54581aa508045b9d28b
SHA512 35d961a7cc671691ab5483cc22c308eb752696cbfb2ab7978c142623c0a96364818a6c5f248c5538ca6274260533a76e8f7c1f3f07ea6e17eff12db8d1ee9e91
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
844	928311 RFQ for Ecc. Reducer.exe
844	928311 RFQ for Ecc. Reducer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	928311 RFQ for Ecc. Reducer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 772	844	928311 RFQ for Ecc. Reducer.exe	28
PID 844 wrote to memory of 772	844	928311 RFQ for Ecc. Reducer.exe	28
PID 844 wrote to memory of 772	844	928311 RFQ for Ecc. Reducer.exe	28
PID 844 wrote to memory of 772	844	928311 RFQ for Ecc. Reducer.exe	28

C:\Users\Admin\AppData\Local\Temp\928311 RFQ for Ecc. Reducer.exe
"C:\Users\Admin\AppData\Local\Temp\928311 RFQ for Ecc. Reducer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 90324
  2⤵
  PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-1-0x0000000001D20000-0x0000000001D31000-memory.dmp

Download