Analysis
- max time kernel
151s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
dcmnter0901.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dcmnter0901.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target dcmnter0901.exe
- Size 857KB
- Sample201109-d5vgza97ae
- SHA256 77d83370f3109b9a0c199c60870edd92184c170abfc2f1817cd625245fcfae10
- MD5 505d10233824711a525ae33fdd0912a2
- SHA1 eff483980f9476827c9ddff3b84ddd4d85f3e876
- SHA512 13900f730dc1ae11d198a2816c43316f72c9507a7d0dcc811830f8f8ad815d4e1b164322541761fb20d38b4a43999e29ec83b494e6702c00eb6156e73e344663
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1120 cmd.exe - Suspicious use of FindShellTrayWindow 168 IoCs
pid Process 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe - Suspicious use of SendNotifyMessage 168 IoCs
pid Process 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe 484 dcmnter0901.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 484 wrote to memory of 1120 484 dcmnter0901.exe 31 PID 484 wrote to memory of 1120 484 dcmnter0901.exe 31 PID 484 wrote to memory of 1120 484 dcmnter0901.exe 31 PID 484 wrote to memory of 1120 484 dcmnter0901.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcmnter0901.exe"C:\Users\Admin\AppData\Local\Temp\dcmnter0901.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C start C:\Users\Admin\AppData\Local\Temp\_4MB6avS5ipNaprzM8M9q\sisfree.exe2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1120
-