Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 18:26
General
- Target 2b2b022ec06038e0e9a4d2dec1361d69.exe
- Size 321KB
- Sample210331-7eljfhxsls
- SHA256 1e93fd2be4ac69ce3d235aae5cb9099fa404376bfa76ade998efd42dd190f735
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b2b022ec06038e0e9a4d2dec1361d69.exe"C:\Users\Admin\AppData\Local\Temp\2b2b022ec06038e0e9a4d2dec1361d69.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4808-2-0x0000000004A50000-0x0000000004A51000-memory.dmp
memory/4808-3-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/4808-4-0x00000000730D0000-0x00000000737BE000-memory.dmp
memory/4808-5-0x0000000004910000-0x000000000494A000-memory.dmp
memory/4808-6-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4808-7-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/4808-8-0x0000000004BB0000-0x0000000004BE5000-memory.dmp
memory/4808-9-0x0000000007500000-0x0000000007501000-memory.dmp
memory/4808-10-0x0000000004E20000-0x0000000004E54000-memory.dmp
memory/4808-11-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/4808-13-0x00000000074F3000-0x00000000074F4000-memory.dmp
memory/4808-12-0x00000000074F2000-0x00000000074F3000-memory.dmp
memory/4808-14-0x00000000074F4000-0x00000000074F6000-memory.dmp
memory/4808-15-0x0000000007DD0000-0x0000000007DD1000-memory.dmp
memory/4808-16-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
memory/4808-17-0x0000000008640000-0x0000000008641000-memory.dmp
memory/4808-18-0x0000000008660000-0x0000000008661000-memory.dmp
memory/4808-19-0x00000000087D0000-0x00000000087D1000-memory.dmp
memory/4808-20-0x0000000008950000-0x0000000008951000-memory.dmp