328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725 | Triage

Analysis

max time kernel
14s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
24-11-2020 02:32

Sharing

Report Analysis Logs

General

Target

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
Size

47KB
MD5

5db68bb58a06af694c3889b60773fe56
SHA1

300d02833757da7c83b0164b5c45562ebc6f41f7
SHA256

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef
SHA512

521fdc93d49268fad1f6c314240fe3615d2de2e2058e4672c08a8f2f22b76c4bcb93a41286268ca8d5db1c42dd700f5c98f04b29ac0032409ea15b77239ec86b

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2428 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe

description pid process

Token: SeDebugPrivilege 4076 8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe

description	pid	process	target process
PID 4076 wrote to memory of 2428	4076	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe
PID 4076 wrote to memory of 2428	4076	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe
PID 4076 wrote to memory of 2428	4076	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
"C:\Users\Admin\AppData\Local\Temp\8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\timeout.exe
  timeout
  2⤵
  - Delays execution with timeout.exe
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-5-0x0000000000000000-mapping.dmp

Download
memory/4076-0-0x00000000739A0000-0x000000007408E000-memory.dmp

Filesize
6.9MB

Download
memory/4076-1-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/4076-3-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/4076-4-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download