4ac466c76827f1d0ea87e1cd6e58df30d182e89920208ea888f1434b03f2e227

Analysis

max time kernel
109s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c4fec10953a06f9194d24042129813e.exe
Size 618KB
Sample201117-39pym157p2
SHA256 4ac466c76827f1d0ea87e1cd6e58df30d182e89920208ea888f1434b03f2e227
MD5 5c4fec10953a06f9194d24042129813e
SHA1 eaa615212da2834cb6ef04b03b9189dc084a5d8a
SHA512 3a318d69d6c8d1016912bd598b8507dea3652ad2d15cf58bf07f6323d5dd373727ced77ada4741a6995d85ff883d12a2a190fcc5da60216592be7984c5e9840f
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 500	580	5c4fec10953a06f9194d24042129813e.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
580	5c4fec10953a06f9194d24042129813e.exe
580	5c4fec10953a06f9194d24042129813e.exe
500	5c4fec10953a06f9194d24042129813e.exe
500	5c4fec10953a06f9194d24042129813e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	5c4fec10953a06f9194d24042129813e.exe
Token: SeDebugPrivilege	500	5c4fec10953a06f9194d24042129813e.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1928	580	5c4fec10953a06f9194d24042129813e.exe	78
PID 580 wrote to memory of 1928	580	5c4fec10953a06f9194d24042129813e.exe	78
PID 580 wrote to memory of 1928	580	5c4fec10953a06f9194d24042129813e.exe	78
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79
PID 580 wrote to memory of 500	580	5c4fec10953a06f9194d24042129813e.exe	79

C:\Users\Admin\AppData\Local\Temp\5c4fec10953a06f9194d24042129813e.exe
"C:\Users\Admin\AppData\Local\Temp\5c4fec10953a06f9194d24042129813e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Local\Temp\5c4fec10953a06f9194d24042129813e.exe
  "{path}"
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\5c4fec10953a06f9194d24042129813e.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/500-19-0x0000000005D10000-0x0000000005D11000-memory.dmp

Download

memory/500-18-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/500-13-0x0000000073190000-0x000000007387E000-memory.dmp

Download

memory/580-4-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/580-8-0x0000000006850000-0x00000000068B1000-memory.dmp

Download

memory/580-9-0x0000000006960000-0x0000000006961000-memory.dmp

Download

memory/580-7-0x0000000005D80000-0x0000000005D94000-memory.dmp

Download

memory/580-6-0x0000000006220000-0x0000000006221000-memory.dmp

Download

memory/580-5-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/580-0-0x0000000073190000-0x000000007387E000-memory.dmp

Download

memory/580-3-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download

memory/580-1-0x0000000000970000-0x0000000000971000-memory.dmp

Download