658553ecc9631400e23f4a3ab88b8dd1f101a1e0d5bb61c434d332878a52c64d

Analysis

max time kernel
18s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
06-01-2021 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02_extracted.exe
Size

512KB
MD5

299e51e32a764ec12716fa4f5ee41fb0
SHA1

71c0a42ae41a86e0f6f8a1d11a358be80a9ac72b
SHA256

658553ecc9631400e23f4a3ab88b8dd1f101a1e0d5bb61c434d332878a52c64d
SHA512

b6d57a4915447dc2d2bfc1368f9edbfb0fd8d37ab8395f9d5e9507bbc78f93a61bb597afdd6aa051256d8b80884c5fd29cb4bb6791d62bc3b4aa035a4e2395bb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

2284 powershell.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

02_extracted.exepowershell.exe

pid process

984 02_extracted.exe
984 02_extracted.exe
2284 powershell.exe
2284 powershell.exe
2284 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

02_extracted.exepowershell.exe

description pid process

Token: SeDebugPrivilege 984 02_extracted.exe
Token: SeDebugPrivilege 2284 powershell.exe

pid	process
2284	powershell.exe

pid	process
984	02_extracted.exe
984	02_extracted.exe
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe

description	pid	process
Token: SeDebugPrivilege	984	02_extracted.exe
Token: SeDebugPrivilege	2284	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

02_extracted.exe

description	pid	process	target process
PID 984 wrote to memory of 2284	984	02_extracted.exe	powershell.exe
PID 984 wrote to memory of 2284	984	02_extracted.exe	powershell.exe
PID 984 wrote to memory of 2284	984	02_extracted.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\02_extracted.exe
"C:\Users\Admin\AppData\Local\Temp\02_extracted.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\02_extracted.exe'
2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-2-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/984-3-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/984-5-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/984-6-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/984-7-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Filesize
4KB

Download
memory/2284-8-0x0000000000000000-mapping.dmp

Download
memory/2284-9-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2284-10-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/2284-11-0x00000000078F0000-0x00000000078F1000-memory.dmp

Filesize
4KB

Download
memory/2284-12-0x00000000077F0000-0x00000000077F1000-memory.dmp

Filesize
4KB

Download
memory/2284-13-0x0000000007F20000-0x0000000007F21000-memory.dmp

Filesize
4KB

Download
memory/2284-15-0x0000000008100000-0x0000000008101000-memory.dmp

Filesize
4KB

Download
memory/2284-16-0x0000000008590000-0x0000000008591000-memory.dmp

Filesize
4KB

Download
memory/2284-17-0x00000000089E0000-0x00000000089E1000-memory.dmp

Filesize
4KB

Download
memory/2284-18-0x00000000088F0000-0x00000000088F1000-memory.dmp

Filesize
4KB

Download
memory/2284-19-0x0000000009E00000-0x0000000009E01000-memory.dmp

Filesize
4KB

Download
memory/2284-20-0x0000000009570000-0x0000000009571000-memory.dmp

Filesize
4KB

Download
memory/2284-21-0x0000000009980000-0x0000000009981000-memory.dmp

Filesize
4KB

Download
memory/2284-22-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads