Analysis
- max time kernel
61s - max time network
122s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/12/2020, 06:56
General
- Target Customer Order, Images, Spec.exe
- Size 1.1MB
- Sample201217-p62tefmdv2
- SHA256 242045c07ffb6427b046939045d9312f3beaa954ef3ec60316247f7dfdfbca3e
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Customer Order, Images, Spec.exe"C:\Users\Admin\AppData\Local\Temp\Customer Order, Images, Spec.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8562⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/188-3-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/188-4-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/188-6-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/188-8-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-9-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/188-10-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-11-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-13-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-12-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-14-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-15-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-16-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-17-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-18-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-19-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-21-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-20-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-22-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-23-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-24-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-25-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-26-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-27-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-28-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-29-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-30-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-31-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-32-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-33-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-34-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-35-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-36-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-37-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-38-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-39-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-40-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-41-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-42-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-43-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-44-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-45-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-46-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-47-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-48-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-49-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-50-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-51-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-52-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-53-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-54-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-55-0x0000000000960000-0x0000000000961000-memory.dmp
memory/188-56-0x0000000000960000-0x0000000000961000-memory.dmp