Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 17:52
General
- Target b9df54c71a347e648c0e024e2b4d9d74.exe
- Size 321KB
- Sample210331-jz2dpb494a
- SHA256 a037c92bc75769e88e0d233c66624d579fda2f356b963caca083d89d8e331d40
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9df54c71a347e648c0e024e2b4d9d74.exe"C:\Users\Admin\AppData\Local\Temp\b9df54c71a347e648c0e024e2b4d9d74.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4768-2-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/4768-3-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/4768-4-0x0000000073070000-0x000000007375E000-memory.dmp
memory/4768-5-0x0000000004BB0000-0x0000000004BE5000-memory.dmp
memory/4768-6-0x0000000002DA0000-0x0000000002DDA000-memory.dmp
memory/4768-7-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4768-9-0x00000000072C0000-0x00000000072C1000-memory.dmp
memory/4768-8-0x0000000004A52000-0x0000000004A53000-memory.dmp
memory/4768-10-0x0000000004A53000-0x0000000004A54000-memory.dmp
memory/4768-11-0x0000000004A50000-0x0000000004A51000-memory.dmp
memory/4768-12-0x0000000004D90000-0x0000000004DC4000-memory.dmp
memory/4768-13-0x00000000077C0000-0x00000000077C1000-memory.dmp
memory/4768-14-0x0000000004A54000-0x0000000004A56000-memory.dmp
memory/4768-15-0x0000000007DD0000-0x0000000007DD1000-memory.dmp
memory/4768-16-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
memory/4768-17-0x0000000008640000-0x0000000008641000-memory.dmp
memory/4768-18-0x0000000008660000-0x0000000008661000-memory.dmp
memory/4768-19-0x00000000087D0000-0x00000000087D1000-memory.dmp
memory/4768-20-0x0000000008950000-0x0000000008951000-memory.dmp