aaf4fe2b9156b1b9372507b031bbab5c49f893fe652ea9d8729da31a1303153e | Triage™

Analysis

max time kernel
111s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
17/11/2020, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8900bde76eb764f75b27ca2157a52b03.exe
Size 1.5MB
Sample201117-331gtn5a4x
SHA256 aaf4fe2b9156b1b9372507b031bbab5c49f893fe652ea9d8729da31a1303153e
MD5 6a94e722a736eeabd2ba6f74124e593a
SHA1 d33de30c6083ac2d63be514b3d41a40bde1580f6
SHA512 2aa5d593757bb499424b58ac77b5526d64202028ede52b8c811ab1ac0c65b109327e8f41508010be02f53fb3bc72c9a1a657cc8546cf4697f895d73258faacd9
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1192	8900bde76eb764f75b27ca2157a52b03.tmp

Loads dropped DLL 3 IoCs

pid	Process
1644	8900bde76eb764f75b27ca2157a52b03.exe
1192	8900bde76eb764f75b27ca2157a52b03.tmp
1192	8900bde76eb764f75b27ca2157a52b03.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	8900bde76eb764f75b27ca2157a52b03.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26
PID 1644 wrote to memory of 1192	1644	8900bde76eb764f75b27ca2157a52b03.exe	26

C:\Users\Admin\AppData\Local\Temp\8900bde76eb764f75b27ca2157a52b03.exe
"C:\Users\Admin\AppData\Local\Temp\8900bde76eb764f75b27ca2157a52b03.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\is-2GLGV.tmp\8900bde76eb764f75b27ca2157a52b03.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2GLGV.tmp\8900bde76eb764f75b27ca2157a52b03.tmp" /SL5="$3011A,1298801,54272,C:\Users\Admin\AppData\Local\Temp\8900bde76eb764f75b27ca2157a52b03.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-0-0x0000000001F80000-0x000000000209A000-memory.dmp

Download