4c0201a24bb5ce9ed7b2a24dc35cbfe03ecb8546a14f549811e7d4a1b314f32f | Triage™

Analysis

max time kernel
113s
max time network
110s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a2b0fcc00b452a592bd3be694fb803f.exe
Size 330KB
Sample201109-9t2mdrbdax
SHA256 4c0201a24bb5ce9ed7b2a24dc35cbfe03ecb8546a14f549811e7d4a1b314f32f
MD5 3a2b0fcc00b452a592bd3be694fb803f
SHA1 c3b9c76f6e040a6b1b3c74f673df1abfc7e489c5
SHA512 c765b1de8203baf142a3121e64fdf3cc586cde1ba7b0b940256a7ec47f9eac2e0bb246c5761f30a62e85f0d119cc8ed4511d2cfcc9afc1aad54f0f8439e2315d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1804	3a2b0fcc00b452a592bd3be694fb803f.exe
1804	3a2b0fcc00b452a592bd3be694fb803f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	3a2b0fcc00b452a592bd3be694fb803f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1508	1804	3a2b0fcc00b452a592bd3be694fb803f.exe	29
PID 1804 wrote to memory of 1508	1804	3a2b0fcc00b452a592bd3be694fb803f.exe	29
PID 1804 wrote to memory of 1508	1804	3a2b0fcc00b452a592bd3be694fb803f.exe	29
PID 1804 wrote to memory of 1508	1804	3a2b0fcc00b452a592bd3be694fb803f.exe	29

C:\Users\Admin\AppData\Local\Temp\3a2b0fcc00b452a592bd3be694fb803f.exe
"C:\Users\Admin\AppData\Local\Temp\3a2b0fcc00b452a592bd3be694fb803f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1048
  2⤵
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-1-0x0000000001DA0000-0x0000000001DB1000-memory.dmp

Download