2527df2823de3eba2ed8f38e433938832ce4d887d843efcb21a860bbd8a14908

Analysis

max time kernel
106s
max time network
21s
platform
windows7_x64
resource
win7v200722
submitted
12/10/2020, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INV930897PO_20201110.exe
Size 639KB
Sample201012-61cvsrdj9a
SHA256 2527df2823de3eba2ed8f38e433938832ce4d887d843efcb21a860bbd8a14908
MD5 bd8d35902014ca9bd341f4061bb6533d
SHA1 66000a5480acac42ecdf1813f3dc5a5f59902cb7
SHA512 936d46590f880ade5c3706f60c9f9863110986ab3d69df243c0af1e71da0bcfa5dab0bfcacd3f6cd60b5e52293f15ecd6f8b9a2ef4a6850b37f6caa47ef008df
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 1152	1516	INV930897PO_20201110.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1152	INV930897PO_20201110.exe
1152	INV930897PO_20201110.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	INV930897PO_20201110.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28
PID 1516 wrote to memory of 1152	1516	INV930897PO_20201110.exe	28

C:\Users\Admin\AppData\Local\Temp\INV930897PO_20201110.exe
"C:\Users\Admin\AppData\Local\Temp\INV930897PO_20201110.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\INV930897PO_20201110.exe
  "C:\Users\Admin\AppData\Local\Temp\INV930897PO_20201110.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-15-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1152-19-0x0000000074820000-0x0000000074F0E000-memory.dmp

Download

memory/1152-18-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1152-17-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1516-4-0x0000000000260000-0x0000000000271000-memory.dmp

Download

memory/1516-12-0x0000000004F90000-0x000000000500C000-memory.dmp

Download

memory/1516-13-0x0000000005010000-0x0000000005072000-memory.dmp

Download

memory/1516-11-0x000000000C760000-0x000000000E75F000-memory.dmp

Download

memory/1516-9-0x0000000000260000-0x0000000000271000-memory.dmp

Download

memory/1516-0-0x0000000074820000-0x0000000074F0E000-memory.dmp

Download

memory/1516-3-0x0000000000AD0000-0x0000000000B4D000-memory.dmp

Download

memory/1516-1-0x0000000001310000-0x0000000001311000-memory.dmp

Download