5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c

Analysis

Target
SOA.exe
Size 883KB
Sample201022-wzdndebn4e
SHA256 5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c
MD5 c785c3142fbe0e47c18403e00a94af7a
SHA1 6950c20de7241b7b16646c28ab94715f54bd4ffb
SHA512 da6e8f42d1544db8aea3b127676037013865c92a30b4e07b0a6ff51a9bbf67d72ba9c145cea808d4bca60b95fbf79abc35323086c0f50b0e810cf606d6e66158
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1616	1588	SOA.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1588	SOA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	SOA.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1624	1588	SOA.exe	28
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1588 wrote to memory of 1616	1588	SOA.exe	29
PID 1616 wrote to memory of 1980	1616	RegSvcs.exe	30
PID 1616 wrote to memory of 1980	1616	RegSvcs.exe	30
PID 1616 wrote to memory of 1980	1616	RegSvcs.exe	30
PID 1616 wrote to memory of 1980	1616	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:1624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 388
    3⤵
    PID:1980

memory/1616-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1616-3-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1616-2-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1980-5-0x0000000001E30000-0x0000000001E41000-memory.dmp

Download

memory/1980-6-0x0000000002300000-0x0000000002311000-memory.dmp

Download