Analysis
-
max time kernel
125s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 23:10
Static task
static1
Behavioral task
behavioral1
Sample
930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe
-
Size
126KB
-
MD5
c6109d4b0ec869d8cca51b6bfd8d6e57
-
SHA1
4fac2582386252e65ab229f5b1b06409123b3133
-
SHA256
930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9
-
SHA512
ea06439160601b614d8258b97158f87b512a11af1402fbca6b76773a0a3d9e352f82a4289840e6e2672aa20903ff301d554bca5031cb420a809e914f14e30063
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 1700 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exedescription pid process Token: SeDebugPrivilege 792 930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exedescription pid process target process PID 792 wrote to memory of 1700 792 930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe dw20.exe PID 792 wrote to memory of 1700 792 930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe dw20.exe PID 792 wrote to memory of 1700 792 930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe"C:\Users\Admin\AppData\Local\Temp\930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 4842⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/792-60-0x00000000023F0000-0x00000000023F2000-memory.dmpFilesize
8KB
-
memory/792-64-0x00000000023F6000-0x0000000002415000-memory.dmpFilesize
124KB
-
memory/792-63-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/1700-61-0x0000000000000000-mapping.dmp
-
memory/1700-62-0x000007FEFB561000-0x000007FEFB563000-memory.dmpFilesize
8KB
-
memory/1700-65-0x0000000001DE0000-0x0000000001E04000-memory.dmpFilesize
144KB