7b99f6a15a14cd9dcaaac8653eec35e1c2d0dc7a72b4df26dec87e34cc7ad061

General

Target
3301-20200923023.exe
Size 1.0MB
Sample201017-yt82bbaqba
SHA256 7b99f6a15a14cd9dcaaac8653eec35e1c2d0dc7a72b4df26dec87e34cc7ad061
MD5 83a916a76a8ad16ba04dec3ca84ba634
SHA1 f267d072b2cd036b00fa7e13fe22f2053e6cff30
SHA512 3c87afdb89dff7e12924d79e3ece8f3f406500c917a20261017daced63c915c4ec9fc249b28ae63d68acca60a4375c1710491dbc5613a6dc0806d0bae2c5bb19
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 3844	2880	3301-20200923023.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
200	2880	WerFault.exe	66

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1036	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2880	3301-20200923023.exe
2880	3301-20200923023.exe
2880	3301-20200923023.exe
3844	3301-20200923023.exe
3844	3301-20200923023.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	3301-20200923023.exe
Token: SeDebugPrivilege	3844	3301-20200923023.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1036	2880	3301-20200923023.exe	72
PID 2880 wrote to memory of 1036	2880	3301-20200923023.exe	72
PID 2880 wrote to memory of 1036	2880	3301-20200923023.exe	72
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78
PID 2880 wrote to memory of 3844	2880	3301-20200923023.exe	78

C:\Users\Admin\AppData\Local\Temp\3301-20200923023.exe
"C:\Users\Admin\AppData\Local\Temp\3301-20200923023.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\timeout.exe
  timeout 18
  2⤵
  - Delays execution with timeout.exe
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\3301-20200923023.exe
  "C:\Users\Admin\AppData\Local\Temp\3301-20200923023.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1708
  2⤵
  - Program crash
  PID:200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/200-14-0x00000000043D0000-0x00000000043D1000-memory.dmp

Download

memory/2880-0-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Download

memory/2880-1-0x00000000003C0000-0x00000000003C1000-memory.dmp

Download

memory/2880-3-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/2880-5-0x0000000000BE0000-0x0000000000C23000-memory.dmp

Download

memory/2880-6-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Download

memory/3844-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3844-9-0x00000000734C0000-0x0000000073BAE000-memory.dmp

Download

memory/3844-15-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download

memory/3844-16-0x0000000005E30000-0x0000000005E31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads