044c16cdbc6ec18f58bfecaacf4d4e21150a19d8d10c694c4a4c3085697499a2 | Triage

Analysis

max time kernel
12s
max time network
14s
platform
windows7_x64
resource
win7v20201028
submitted
04-01-2021 02:13

Sharing

Report Analysis Logs

General

Target

b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2044	Run.exe

Loads dropped DLL 5 IoCs

pid	Process
1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe
1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe
2044	Run.exe
2044	Run.exe
2044	Run.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2044	Run.exe
2044	Run.exe
2044	Run.exe
2044	Run.exe
2044	Run.exe
2044	Run.exe
2044	Run.exe
2044	Run.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	Run.exe
2044	Run.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26
PID 1204 wrote to memory of 2044	1204	b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe	26

C:\Users\Admin\AppData\Local\Temp\b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe
"C:\Users\Admin\AppData\Local\Temp\b6c343fd90ce107bd1e0ea2fec6b5d3a33637f0a6daa251256a533e426aa796f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\7zS55ED.tmp\Run.exe
  .\Run.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads