Analysis
- max time kernel
3s - max time network
8s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/11/2020, 12:19
General
- Target a01d2b1d45cb07545905c6525e20c6bc.exe
- Size 208KB
- Sample201117-62887pdryn
- SHA256 9dc9e84417abae2d03346b9855469e751126477b52412bf9eff8f7aa09bb35ab
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 3 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01d2b1d45cb07545905c6525e20c6bc.exe"C:\Users\Admin\AppData\Local\Temp\a01d2b1d45cb07545905c6525e20c6bc.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\JXRYFV.exe.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\JXRYFV.exeC:\windows\system32\JXRYFV.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-