3aaaf20441f4c63cae5963d1a4244c443a32d517b95be1a26d8c77f2debca232

Analysis

max time kernel
109s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
25/11/2020, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ER mexico.exe
Size 883KB
Sample201125-8xae5xtgqe
SHA256 3aaaf20441f4c63cae5963d1a4244c443a32d517b95be1a26d8c77f2debca232
MD5 c5c8044c62cc54b3c5b80fe8ccb8aaf5
SHA1 5ce4dbbf1cf175d77eae7cbfb0506c3e7cee7947
SHA512 94a2201499f796ac5d20a68d3bbc54eab5f91bbd7f41308f1a08330a0c8077c937c0799a7f1a581d4d17ec22ca3042a8aaadbf5c053412733db8505b47e8272e
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 1160	984	ER mexico.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1160	ER mexico.exe
1160	ER mexico.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	ER mexico.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78
PID 984 wrote to memory of 1160	984	ER mexico.exe	78

C:\Users\Admin\AppData\Local\Temp\ER mexico.exe
"C:\Users\Admin\AppData\Local\Temp\ER mexico.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\ER mexico.exe
  "C:\Users\Admin\AppData\Local\Temp\ER mexico.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-5-0x0000000005840000-0x0000000005841000-memory.dmp

Download

memory/984-9-0x0000000001430000-0x0000000001497000-memory.dmp

Download

memory/984-4-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Download

memory/984-0-0x0000000073840000-0x0000000073F2E000-memory.dmp

Download

memory/984-6-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/984-7-0x00000000059A0000-0x00000000059A1000-memory.dmp

Download

memory/984-3-0x00000000056F0000-0x00000000056F1000-memory.dmp

Download

memory/984-1-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/984-8-0x0000000005A00000-0x0000000005A13000-memory.dmp

Download

memory/984-10-0x00000000014A0000-0x00000000014D9000-memory.dmp

Download

memory/1160-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1160-14-0x0000000073840000-0x0000000073F2E000-memory.dmp

Download

memory/1160-19-0x00000000054F0000-0x00000000054F1000-memory.dmp

Download

memory/1160-20-0x0000000006060000-0x0000000006061000-memory.dmp

Download