Analysis
- max time kernel
18s - max time network
113s - platform
windows10_x64 - resource
win10v200722 - submitted
07/10/2020, 04:54
General
- Target manmanman.exe
- Size 1.1MB
- Sample201007-pfkty5m9za
- SHA256 0adc7e74c78f1d91fa1972467bdee948477ade15409a3f2924f337de4038ded1
Malware Config
Signatures
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\manmanman.exe"C:\Users\Admin\AppData\Local\Temp\manmanman.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
-
-
C:\Users\Admin\AppData\Local\Temp\manmanman.exe"C:\Users\Admin\AppData\Local\Temp\manmanman.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\manmanman.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/508-0-0x0000000000400000-0x000000000051D000-memory.dmp
memory/3036-21-0x0000000008430000-0x0000000008431000-memory.dmp
memory/3036-16-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3036-28-0x0000000007650000-0x0000000007651000-memory.dmp
memory/3036-27-0x0000000009C40000-0x0000000009C41000-memory.dmp
memory/3036-26-0x00000000097C0000-0x00000000097C1000-memory.dmp
memory/3036-25-0x000000000A020000-0x000000000A021000-memory.dmp
memory/3036-15-0x0000000073A10000-0x00000000740FE000-memory.dmp
memory/3036-24-0x0000000008AC0000-0x0000000008AC1000-memory.dmp
memory/3036-23-0x0000000008C30000-0x0000000008C31000-memory.dmp
memory/3036-22-0x0000000008230000-0x0000000008231000-memory.dmp
memory/3036-19-0x0000000007AB0000-0x0000000007AB1000-memory.dmp
memory/3036-18-0x0000000007A10000-0x0000000007A11000-memory.dmp
memory/3036-17-0x0000000007B40000-0x0000000007B41000-memory.dmp
memory/3648-2-0x0000000000400000-0x000000000051E000-memory.dmp
memory/3648-8-0x00000000734A0000-0x0000000073B8E000-memory.dmp
memory/3648-13-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/3648-12-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/3648-11-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/3648-7-0x0000000002312000-0x0000000002313000-memory.dmp
memory/3648-6-0x0000000002320000-0x00000000023A6000-memory.dmp
memory/3648-5-0x0000000000400000-0x000000000051E000-memory.dmp
memory/3648-4-0x0000000000400000-0x000000000051E000-memory.dmp