e0cb1fe1256cbf26178ffac07b55cdbd9ed9e9cd53d1d2642f8ba43db84cf8b4

Analysis

max time kernel
103s
max time network
69s
platform
windows10_x64
resource
win10v20201028
submitted
18/11/2020, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mcaceres.exe
Size 699KB
Sample201118-b51ldf7cln
SHA256 e0cb1fe1256cbf26178ffac07b55cdbd9ed9e9cd53d1d2642f8ba43db84cf8b4
MD5 547dc41c35d76c0d125ba2b6cfa32a1b
SHA1 9898c5e3ef2d6667d2534f8afda6d1d02b5defeb
SHA512 fe1fac368a998f4078dbdb4857b2087f554354b0ce7b2691463c99fc5ccb6fe5dee42f7f89162eb1ef4c6ab9e98aa8158d07d5231e01b9f80648de16d28ded7f
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 4004	884	mcaceres.exe	80

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
884	mcaceres.exe
884	mcaceres.exe
884	mcaceres.exe
884	mcaceres.exe
884	mcaceres.exe
884	mcaceres.exe
4004	mcaceres.exe
4004	mcaceres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	mcaceres.exe
Token: SeDebugPrivilege	4004	mcaceres.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1520	884	mcaceres.exe	79
PID 884 wrote to memory of 1520	884	mcaceres.exe	79
PID 884 wrote to memory of 1520	884	mcaceres.exe	79
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80
PID 884 wrote to memory of 4004	884	mcaceres.exe	80

C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
"C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-9-0x00000000085D0000-0x000000000863E000-memory.dmp

Download

memory/884-11-0x0000000008640000-0x0000000008679000-memory.dmp

Download

memory/884-4-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

Download

memory/884-5-0x00000000079E0000-0x00000000079E1000-memory.dmp

Download

memory/884-6-0x00000000078F0000-0x00000000078F1000-memory.dmp

Download

memory/884-7-0x0000000007BE0000-0x0000000007BE1000-memory.dmp

Download

memory/884-3-0x0000000007940000-0x0000000007941000-memory.dmp

Download

memory/884-8-0x0000000002980000-0x0000000002994000-memory.dmp

Download

memory/884-10-0x0000000007930000-0x0000000007936000-memory.dmp

Download

memory/884-0-0x0000000073A30000-0x000000007411E000-memory.dmp

Download

memory/884-1-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/4004-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4004-15-0x0000000073A30000-0x000000007411E000-memory.dmp

Download

memory/4004-20-0x0000000006450000-0x0000000006451000-memory.dmp

Download

memory/4004-21-0x00000000064F0000-0x00000000064F1000-memory.dmp

Download