Analysis
- max time kernel
151s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
dcmnter0901.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dcmnter0901.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target dcmnter0901.exe
- Size 857KB
- Sample201109-d5vgza97ae
- SHA256 77d83370f3109b9a0c199c60870edd92184c170abfc2f1817cd625245fcfae10
- MD5 505d10233824711a525ae33fdd0912a2
- SHA1 eff483980f9476827c9ddff3b84ddd4d85f3e876
- SHA512 13900f730dc1ae11d198a2816c43316f72c9507a7d0dcc811830f8f8ad815d4e1b164322541761fb20d38b4a43999e29ec83b494e6702c00eb6156e73e344663
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 188 IoCs
pid Process 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe - Suspicious use of SendNotifyMessage 188 IoCs
pid Process 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe 4684 dcmnter0901.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3980 4684 dcmnter0901.exe 77 PID 4684 wrote to memory of 3980 4684 dcmnter0901.exe 77 PID 4684 wrote to memory of 3980 4684 dcmnter0901.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcmnter0901.exe"C:\Users\Admin\AppData\Local\Temp\dcmnter0901.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C start C:\Users\Admin\AppData\Local\Temp\_317W09p62t7cOM42J695\sisfree.exe2⤵PID:3980
-