Analysis
- max time kernel
111s - max time network
9s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/11/2020, 12:34
General
- Target 9cc3ce5169e88ff2cad404d7a91fd674.exe
- Size 1.2MB
- Sample201117-npkdvwe83x
- SHA256 0ae092d6c1b1378fc208be8edcfaba68d273a097e840422862bb2ca5c7148d9b
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cc3ce5169e88ff2cad404d7a91fd674.exe"C:\Users\Admin\AppData\Local\Temp\9cc3ce5169e88ff2cad404d7a91fd674.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6R6OH.tmp\9cc3ce5169e88ff2cad404d7a91fd674.tmp"C:\Users\Admin\AppData\Local\Temp\is-6R6OH.tmp\9cc3ce5169e88ff2cad404d7a91fd674.tmp" /SL5="$30108,981855,56832,C:\Users\Admin\AppData\Local\Temp\9cc3ce5169e88ff2cad404d7a91fd674.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1808-0-0x0000000002020000-0x00000000020F8000-memory.dmp
memory/1808-1-0x00000000024A0000-0x0000000002578000-memory.dmp
memory/1808-2-0x0000000002920000-0x00000000029F8000-memory.dmp