Overview

overview

10

Static

static

eb27341254...de.exe

windows7_x64

1

eb27341254...de.exe

windows10_x64

10

Analysis

  • max time kernel
    55s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16-01-2021 12:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

  • Size

    806KB

  • MD5

    c08c591f773ecee016ad60496e99ac49

  • SHA1

    6326dac07e8db5d9c4b328e81e806cd9449eca9a

  • SHA256

    eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de

  • SHA512

    834ef514a5e7e1a06cb38fbadc04b62caf80f0a31feb06ad9534799e99ba90a92c6d04bba31c878df84ee9d5f1af35562a533ded54c37d003f9a16009f07d6e8

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
    "C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
      "C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
      2⤵
        PID:1692
      • C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
        "C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
        2⤵
          PID:308
        • C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
          "C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
          2⤵
            PID:1664
          • C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
            "C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
            2⤵
              PID:544
            • C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
              "C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
              2⤵
                PID:388

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1824-2-0x0000000073980000-0x000000007406E000-memory.dmp
              Filesize

              6.9MB

              Download
            • memory/1824-3-0x00000000003D0000-0x00000000003D1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1824-5-0x00000000003A0000-0x00000000003B2000-memory.dmp
              Filesize

              72KB

              Download
            • memory/1824-6-0x0000000004BE0000-0x0000000004C32000-memory.dmp
              Filesize

              328KB

              Download