163664b77af11e2ddf4fcee996eab157f13e02ac2536dff6a585ef100088492f | Triage

Resubmissions

19-04-2021 08:56

210419-x2q1njegga 10

19-04-2021 08:19

210419-328r2qg91x 10

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7v20210410
submitted
19-04-2021 08:56

Sharing

Report Analysis Logs

General

Target

2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

Processes:

2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe
File opened for modification	C:\Windows\Tasks\wow64.job	2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1444 wrote to memory of 1324	1444	taskeng.exe	2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe
PID 1444 wrote to memory of 1324	1444	taskeng.exe	2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe
PID 1444 wrote to memory of 1324	1444	taskeng.exe	2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe
PID 1444 wrote to memory of 1324	1444	taskeng.exe	2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe

C:\Users\Admin\AppData\Local\Temp\2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe
"C:\Users\Admin\AppData\Local\Temp\2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe"
1⤵
- Drops file in Windows directory
PID:792

C:\Windows\system32\taskeng.exe
taskeng.exe {4BB3DB42-A48A-4D6D-AD08-2F841C84ACA5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe
  C:\Users\Admin\AppData\Local\Temp\2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a.exe start
  2⤵
  PID:1324

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-59-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1012-62-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download
memory/1324-60-0x0000000000000000-mapping.dmp

Download