Analysis
- max time kernel
88s - max time network
149s - platform
windows10_x64 - resource
win10v200722 - submitted
23/10/2020, 06:50
General
- Target GLOBAL VISION Trading Est.exe
- Size 729KB
- Sample201023-anx4ae47n2
- SHA256 d64ff1049db3e5f29c8bb4ffb78e5ef42067ecd90d1524ea6f1fdf39d944c4d0
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GLOBAL VISION Trading Est.exe"C:\Users\Admin\AppData\Local\Temp\GLOBAL VISION Trading Est.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 80202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3908-0-0x0000000073DE0000-0x00000000744CE000-memory.dmp
memory/3908-1-0x0000000000550000-0x0000000000551000-memory.dmp
memory/3908-3-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/3908-4-0x00000000051A0000-0x00000000051DA000-memory.dmp
memory/3936-6-0x0000000004530000-0x0000000004531000-memory.dmp
memory/3936-7-0x0000000004A70000-0x0000000004A71000-memory.dmp