Analysis

  • max time kernel
    59s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    14/10/2020, 05:50

General

  • Target

    1 (9).exe

  • Size

    5.6MB

  • MD5

    74ae1f78e710ffa4640c5bde890c8bae

  • SHA1

    2626eecb877dffa988e578b7267a808c82d413f7

  • SHA256

    a4b5ccb2649742c9c1070f48b46957585830b0acda29a704b146632b46c99c9e

  • SHA512

    44a6a11c3f94f43501ffb101732e82319d9c8041064fe4bfa5addf6250cdaa4d04106571f240e64689e98fe037428b593231c331ee5e2b16e85e9c7896891751

Score
8/10

Malware Config

Signatures

  • Blacklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 851 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1 (9).exe
    "C:\Users\Admin\AppData\Local\Temp\1 (9).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe
      2⤵
      • Blacklisted process makes network request
      PID:3824
  • C:\Users\Admin\AppData\Local\Temp\1 (9).exe
    C:\Users\Admin\AppData\Local\Temp\1 (9).exe 34706438
    1⤵
      PID:3332

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3288-0-0x00000000001A0000-0x00000000001CF000-memory.dmp

            Filesize

            188KB

          • memory/3288-1-0x0000000140000000-0x000000014002D000-memory.dmp

            Filesize

            180KB

          • memory/3824-2-0x00007FF748B30000-0x00007FF748B74000-memory.dmp

            Filesize

            272KB

          • memory/3824-4-0x00007FF748B30000-0x00007FF748B74000-memory.dmp

            Filesize

            272KB