Analysis
- max time kernel
150s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:41
General
- Target PAYMENT SLIP COPY.exe
- Size 373KB
- Sample201109-s9nv1pexfe
- SHA256 15c86f03a9ef0aa9720a510fd21972a675d15c40ad3efbf52ff2e5cc9bb86c57
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP COPY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP COPY.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-0-0x0000000073E30000-0x000000007451E000-memory.dmp
memory/4636-1-0x0000000000920000-0x0000000000921000-memory.dmp
memory/4636-3-0x0000000005610000-0x0000000005611000-memory.dmp
memory/4636-4-0x0000000005200000-0x0000000005201000-memory.dmp
memory/4636-5-0x00000000051E0000-0x00000000051E2000-memory.dmp
memory/4636-6-0x00000000052A0000-0x00000000052E1000-memory.dmp
memory/4636-7-0x0000000005390000-0x0000000005391000-memory.dmp
memory/4636-8-0x0000000005310000-0x000000000531F000-memory.dmp
memory/4636-9-0x0000000005430000-0x0000000005431000-memory.dmp