Analysis
- max time kernel
57s - max time network
59s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/11/2020, 11:56
General
- Target a2078ba859cf750820dff2cdf4431e9c.exe
- Size 208KB
- Sample201117-sve1s2c7qa
- SHA256 e464444282c39c8c849b32e50864ac28b2edb9d3ccf880a65d68db1b0c3e31dc
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2078ba859cf750820dff2cdf4431e9c.exe"C:\Users\Admin\AppData\Local\Temp\a2078ba859cf750820dff2cdf4431e9c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\APTCEZ.exe.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\windows\system\APTCEZ.exeC:\windows\system\APTCEZ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-