Analysis
- max time kernel
135s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:58
General
- Target INV.exe
- Size 175KB
- Sample201109-v94c99a7gn
- SHA256 aa025c5073c737b73d42bc9295b7622e9c0b2db8a7bb9f480ba45a76a18259f3
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV.exe"C:\Users\Admin\AppData\Local\Temp\INV.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn rPPsXc0ppjyUHal6Aib.exe /tr C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exeC:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exeC:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exeC:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1320-20-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/1320-24-0x0000000006C80000-0x0000000006C81000-memory.dmp
memory/1320-28-0x0000000007980000-0x0000000007981000-memory.dmp
memory/1320-9-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/1320-15-0x0000000006650000-0x0000000006651000-memory.dmp
memory/1320-16-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/1320-17-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/1320-18-0x0000000007300000-0x0000000007301000-memory.dmp
memory/1320-19-0x00000000060C0000-0x00000000060C1000-memory.dmp
memory/1320-27-0x0000000007110000-0x0000000007111000-memory.dmp
memory/1320-21-0x0000000006020000-0x0000000006021000-memory.dmp
memory/1320-22-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
memory/1320-23-0x00000000061B0000-0x00000000061B1000-memory.dmp
memory/1320-26-0x00000000065D0000-0x00000000065D1000-memory.dmp
memory/1320-25-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
memory/3140-52-0x0000000073AC0000-0x00000000741AE000-memory.dmp
memory/3940-31-0x0000000073AC0000-0x00000000741AE000-memory.dmp
memory/3940-46-0x0000000006410000-0x0000000006411000-memory.dmp
memory/3940-49-0x00000000069E0000-0x00000000069E1000-memory.dmp
memory/3980-0-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/3980-5-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/3980-4-0x0000000005930000-0x0000000005931000-memory.dmp
memory/3980-3-0x0000000005F10000-0x0000000005F11000-memory.dmp
memory/3980-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmp