Analysis

  • max time kernel
    9s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    13/10/2020, 14:56

General

  • Target
    b12eb506a5ee264b880686ac4bb29e8d.exe
  • Size 182KB
  • Sample201013-mt2ryksnv6
  • SHA256 23bd17fba8c0cb660dada2c952431dc7e335bbdfb8e34078da941a29652526d5
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1277 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b12eb506a5ee264b880686ac4bb29e8d.exe
    "C:\Users\Admin\AppData\Local\Temp\b12eb506a5ee264b880686ac4bb29e8d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\b12eb506a5ee264b880686ac4bb29e8d.exe
      "C:\Users\Admin\AppData\Local\Temp\b12eb506a5ee264b880686ac4bb29e8d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1700
      • \??\c:\windows\SysWOW64\cmstp.exe
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\t2mta4df.inf
        3⤵
          PID:1900

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1104-0-0x00000000744A0000-0x0000000074B8E000-memory.dmp

          memory/1104-1-0x0000000000350000-0x0000000000351000-memory.dmp

          memory/1104-3-0x0000000000540000-0x000000000055D000-memory.dmp

          memory/1104-4-0x00000000004F0000-0x00000000004FD000-memory.dmp

          memory/1700-5-0x0000000000400000-0x0000000000418000-memory.dmp

          memory/1700-7-0x0000000000400000-0x0000000000418000-memory.dmp

          memory/1700-8-0x0000000000400000-0x0000000000418000-memory.dmp

          memory/1700-9-0x0000000073DB0000-0x000000007449E000-memory.dmp

          memory/1700-12-0x00000000003E0000-0x00000000003E5000-memory.dmp