Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
01/04/2021, 13:01
General
- Target dd33f19f8304c9b080ece59f76be2340.exe
- Size 419KB
- Sample210401-8bbkfjxwpj
- SHA256 0f1153b16dce8a116e175a92d04d463ecc113b79cf1a5991462a320924e0e2df
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd33f19f8304c9b080ece59f76be2340.exe"C:\Users\Admin\AppData\Local\Temp\dd33f19f8304c9b080ece59f76be2340.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4772-2-0x0000000001DD0000-0x0000000001DD1000-memory.dmp
memory/4772-3-0x0000000003860000-0x0000000003861000-memory.dmp
memory/4772-4-0x0000000073240000-0x000000007392E000-memory.dmp
memory/4772-5-0x0000000003960000-0x0000000003995000-memory.dmp
memory/4772-6-0x0000000005EF0000-0x0000000005EF1000-memory.dmp
memory/4772-7-0x0000000003A00000-0x0000000003A34000-memory.dmp
memory/4772-9-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4772-10-0x0000000003B20000-0x0000000003B21000-memory.dmp
memory/4772-11-0x0000000003B22000-0x0000000003B23000-memory.dmp
memory/4772-12-0x0000000003A40000-0x0000000003A41000-memory.dmp
memory/4772-13-0x0000000003B23000-0x0000000003B24000-memory.dmp
memory/4772-8-0x0000000001C60000-0x0000000001C9A000-memory.dmp
memory/4772-14-0x0000000003B24000-0x0000000003B26000-memory.dmp
memory/4772-15-0x0000000003B70000-0x0000000003B71000-memory.dmp
memory/4772-16-0x0000000006A70000-0x0000000006A71000-memory.dmp
memory/4772-17-0x00000000070E0000-0x00000000070E1000-memory.dmp
memory/4772-18-0x0000000007100000-0x0000000007101000-memory.dmp
memory/4772-19-0x0000000007270000-0x0000000007271000-memory.dmp
memory/4772-20-0x00000000073F0000-0x00000000073F1000-memory.dmp