25f6ed9bb32723c139d4abfccf345db631a8483dde664eabd956071ee4b08de4 | Triage

Analysis

max time kernel
106s
max time network
105s
platform
windows7_x64
resource
win7v20201028
submitted
19-01-2021 16:19

Sharing

Report Analysis Logs

General

Target

aLjBjGUvWecwGptNRQryBtRBaVCtO.exe
Size

215KB
MD5

db3f95f2c39e8547f1fa72c608a8be11
SHA1

12c449b97c31faf2a43bd8eb3e91e9b1fd15672c
SHA256

25f6ed9bb32723c139d4abfccf345db631a8483dde664eabd956071ee4b08de4
SHA512

d72698da82a4d80e460405101b7de3ec33b4d9baa9be3fe53950c3d9d46646e3d4722767d094d2754bdb29cdec7aadcd985df3fe10d01f4d72d521bf0b5fc0ee

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aLjBjGUvWecwGptNRQryBtRBaVCtO.exe

pid process

1088 aLjBjGUvWecwGptNRQryBtRBaVCtO.exe
1088 aLjBjGUvWecwGptNRQryBtRBaVCtO.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aLjBjGUvWecwGptNRQryBtRBaVCtO.exe

description pid process

Token: SeDebugPrivilege 1088 aLjBjGUvWecwGptNRQryBtRBaVCtO.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aLjBjGUvWecwGptNRQryBtRBaVCtO.exe

description	pid	process	target process
PID 1088 wrote to memory of 1728	1088	aLjBjGUvWecwGptNRQryBtRBaVCtO.exe	dw20.exe
PID 1088 wrote to memory of 1728	1088	aLjBjGUvWecwGptNRQryBtRBaVCtO.exe	dw20.exe
PID 1088 wrote to memory of 1728	1088	aLjBjGUvWecwGptNRQryBtRBaVCtO.exe	dw20.exe
PID 1088 wrote to memory of 1728	1088	aLjBjGUvWecwGptNRQryBtRBaVCtO.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\aLjBjGUvWecwGptNRQryBtRBaVCtO.exe
"C:\Users\Admin\AppData\Local\Temp\aLjBjGUvWecwGptNRQryBtRBaVCtO.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 516
2⤵
PID:1728

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-2-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1088-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1728-4-0x0000000000000000-mapping.dmp

Download
memory/1728-5-0x00000000020C0000-0x00000000020D1000-memory.dmp

Filesize
68KB

Download
memory/1728-7-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download