Analysis
-
max time kernel
36s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:17
Static task
static1
Behavioral task
behavioral1
Sample
PO2836#NZ232.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
PO2836#NZ232.exe
-
Size
1.2MB
-
MD5
8b9f701b5feeb6d1fc76b9a45ef33695
-
SHA1
c50e76a3bc942145b6d73e7d0fe3d34f2627df10
-
SHA256
1498cb2f9fa31c5126db058a10187fa76040789d257ac2b61f4d4bbbe77a986c
-
SHA512
c0e51d97e681c3d4b89d6e451e2fd908b92085359464088b3ef0f8446ffc9291d2fba5b9673b951ee84921ce62b3a4d7c0959e55baf5586c552e430d55da1f8c
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
PO2836#NZ232.exepid process 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe 844 PO2836#NZ232.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO2836#NZ232.exedescription pid process Token: SeDebugPrivilege 844 PO2836#NZ232.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PO2836#NZ232.exedescription pid process target process PID 844 wrote to memory of 664 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 664 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 664 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 664 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 1748 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 1748 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 1748 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 1748 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 696 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 696 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 696 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 696 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 400 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 400 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 400 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 400 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 268 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 268 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 268 844 PO2836#NZ232.exe PO2836#NZ232.exe PID 844 wrote to memory of 268 844 PO2836#NZ232.exe PO2836#NZ232.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO2836#NZ232.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-2-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/844-3-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/844-5-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/844-6-0x00000000043A0000-0x00000000043EC000-memory.dmpFilesize
304KB