328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725 | Triage

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7v20201028
submitted
24-11-2020 02:32

Sharing

Report Analysis Logs

General

Target

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
Size

47KB
MD5

5db68bb58a06af694c3889b60773fe56
SHA1

300d02833757da7c83b0164b5c45562ebc6f41f7
SHA256

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef
SHA512

521fdc93d49268fad1f6c314240fe3615d2de2e2058e4672c08a8f2f22b76c4bcb93a41286268ca8d5db1c42dd700f5c98f04b29ac0032409ea15b77239ec86b

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2024 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe

description pid process

Token: SeDebugPrivilege 1080 8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe

description	pid	process	target process
PID 1080 wrote to memory of 2024	1080	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe
PID 1080 wrote to memory of 2024	1080	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe
PID 1080 wrote to memory of 2024	1080	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe
PID 1080 wrote to memory of 2024	1080	8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
"C:\Users\Admin\AppData\Local\Temp\8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\timeout.exe
timeout
2⤵
- Delays execution with timeout.exe
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-0-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1080-1-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/2024-3-0x0000000000000000-mapping.dmp

Download