Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
01/04/2021, 06:36
General
- Target a24ecaab4e0e9b568dd8738e590e57bb.exe
- Size 320KB
- Sample210401-5hl37tyde6
- SHA256 127094ebdef2ba4286949a781d2d756ddc8ae76b42e14b0ba49da4ba6d191444
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a24ecaab4e0e9b568dd8738e590e57bb.exe"C:\Users\Admin\AppData\Local\Temp\a24ecaab4e0e9b568dd8738e590e57bb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1144-2-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/1144-3-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/1144-4-0x0000000073320000-0x0000000073A0E000-memory.dmp
memory/1144-5-0x0000000004A40000-0x0000000004A74000-memory.dmp
memory/1144-6-0x0000000007370000-0x0000000007371000-memory.dmp
memory/1144-7-0x0000000002D30000-0x0000000002D6A000-memory.dmp
memory/1144-8-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1144-9-0x0000000007360000-0x0000000007361000-memory.dmp
memory/1144-10-0x0000000007362000-0x0000000007363000-memory.dmp
memory/1144-12-0x0000000004E00000-0x0000000004E32000-memory.dmp
memory/1144-11-0x0000000007363000-0x0000000007364000-memory.dmp
memory/1144-13-0x00000000071D0000-0x00000000071D1000-memory.dmp
memory/1144-14-0x0000000007364000-0x0000000007366000-memory.dmp
memory/1144-15-0x0000000007CB0000-0x0000000007CB1000-memory.dmp
memory/1144-16-0x0000000007E70000-0x0000000007E71000-memory.dmp
memory/1144-17-0x0000000008500000-0x0000000008501000-memory.dmp
memory/1144-18-0x0000000008520000-0x0000000008521000-memory.dmp
memory/1144-19-0x0000000008690000-0x0000000008691000-memory.dmp
memory/1144-20-0x0000000008810000-0x0000000008811000-memory.dmp