Analysis
-
max time kernel
114s -
max time network
19s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 14:07
Static task
static1
Behavioral task
behavioral1
Sample
14500.50.Deposit.exe
Resource
win7v20210408
0 signatures
0 seconds
General
-
Target
14500.50.Deposit.exe
-
Size
712KB
-
MD5
93b2ca391610d14085551d30b9b4dba8
-
SHA1
55e76c4988018dc93df899e2cda607418325910b
-
SHA256
6bd5e5d02430922bfce2893c805028ae0374fee203235b379856f8bc5f574a76
-
SHA512
c5f5f4a69885763a1fb620ff3aedc2abb76d648fe521c30bfdd9577e7e682c9343038db9ea640d6016813cab2c791a4caf1b2fc5bd24ae41cbfc1f70ba5f40a1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
14500.50.Deposit.exepid process 1816 14500.50.Deposit.exe 1816 14500.50.Deposit.exe 1816 14500.50.Deposit.exe 1816 14500.50.Deposit.exe 1816 14500.50.Deposit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
14500.50.Deposit.exedescription pid process Token: SeDebugPrivilege 1816 14500.50.Deposit.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
14500.50.Deposit.exedescription pid process target process PID 1816 wrote to memory of 796 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 796 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 796 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 796 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1768 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1768 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1768 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1768 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 276 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 276 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 276 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 276 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 984 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 984 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 984 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 984 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1668 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1668 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1668 1816 14500.50.Deposit.exe 14500.50.Deposit.exe PID 1816 wrote to memory of 1668 1816 14500.50.Deposit.exe 14500.50.Deposit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"C:\Users\Admin\AppData\Local\Temp\14500.50.Deposit.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1816-60-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1816-62-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1816-63-0x0000000000540000-0x000000000054E000-memory.dmpFilesize
56KB
-
memory/1816-64-0x0000000005060000-0x0000000005107000-memory.dmpFilesize
668KB
-
memory/1816-65-0x0000000004C70000-0x0000000004CD2000-memory.dmpFilesize
392KB