930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9 | Triage

Analysis

max time kernel
12s
max time network
136s
platform
windows10_x64
resource
win10v20210410
submitted
21-04-2021 23:10

Sharing

Report Analysis Logs

General

Target

930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe
Size

126KB
MD5

c6109d4b0ec869d8cca51b6bfd8d6e57
SHA1

4fac2582386252e65ab229f5b1b06409123b3133
SHA256

930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9
SHA512

ea06439160601b614d8258b97158f87b512a11af1402fbca6b76773a0a3d9e352f82a4289840e6e2672aa20903ff301d554bca5031cb420a809e914f14e30063

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dw20.exe

pid process

3216 dw20.exe
3216 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe

description pid process

Token: SeDebugPrivilege 2256 930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe

description	pid	process	target process
PID 2256 wrote to memory of 3216	2256	930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe	dw20.exe
PID 2256 wrote to memory of 3216	2256	930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe
"C:\Users\Admin\AppData\Local\Temp\930766024be47d4cfbcb630ac303bd063e9db01eb25755986b70c8f0d83e35a9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 768
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-114-0x00000000014F0000-0x00000000014F2000-memory.dmp

Filesize
8KB

Download
memory/2256-115-0x00000000014D0000-0x00000000014D1000-memory.dmp

Filesize
4KB

Download
memory/2256-117-0x00000000014F2000-0x00000000014F4000-memory.dmp

Filesize
8KB

Download
memory/3216-116-0x0000000000000000-mapping.dmp

Download