Analysis
- max time kernel
115s - max time network
118s - platform
windows10_x64 - resource
win10v200722 - submitted
16/10/2020, 18:55
General
- Target PR 1000151256 with Mclean Oct 20-MAM PO 3390855.exe
- Size 925KB
- Sample201016-ffbc6vky52
- SHA256 95b6a02e3bfccd61edaa3f291e2daaed0ee8852a80f26ac7ecb6a1ed7c416845
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PR 1000151256 with Mclean Oct 20-MAM PO 3390855.exe"C:\Users\Admin\AppData\Local\Temp\PR 1000151256 with Mclean Oct 20-MAM PO 3390855.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\PR 1000151256 with Mclean Oct 20-MAM PO 3390855.exe" "C:\Users\Admin\Optimizer\CellularGateway.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3308-0-0x0000000073930000-0x000000007401E000-memory.dmp
memory/3308-1-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/3308-3-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/3308-4-0x0000000002590000-0x00000000025A7000-memory.dmp
memory/3308-5-0x0000000004CF0000-0x0000000004D0F000-memory.dmp
memory/3308-6-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/3308-7-0x00000000075F0000-0x00000000075F1000-memory.dmp