Analysis
-
max time kernel
140s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 13:31
Static task
static1
Behavioral task
behavioral1
Sample
da.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
da.exe
-
Size
875KB
-
MD5
9fdf605ce0358540d48502367e637b0a
-
SHA1
1416ebf9b0382a8794bb89f5ee947ec668ce7fdb
-
SHA256
df22601db1675ce639bc8efe21534f7371050ae9637f6cdf38bc23ae6c18efdf
-
SHA512
a194aba3f8c20669ff741ccb59ce7b7023123e1e7984d6d6306a9099d78775ba7bdb92691c26b39522ede6f799f34e96d6b14db1e66429bea26077b95e805bf7
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
da.exepid process 540 da.exe 540 da.exe 540 da.exe 540 da.exe 540 da.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
da.exedescription pid process Token: SeDebugPrivilege 540 da.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
da.exedescription pid process target process PID 540 wrote to memory of 332 540 da.exe da.exe PID 540 wrote to memory of 332 540 da.exe da.exe PID 540 wrote to memory of 332 540 da.exe da.exe PID 540 wrote to memory of 332 540 da.exe da.exe PID 540 wrote to memory of 572 540 da.exe da.exe PID 540 wrote to memory of 572 540 da.exe da.exe PID 540 wrote to memory of 572 540 da.exe da.exe PID 540 wrote to memory of 572 540 da.exe da.exe PID 540 wrote to memory of 640 540 da.exe da.exe PID 540 wrote to memory of 640 540 da.exe da.exe PID 540 wrote to memory of 640 540 da.exe da.exe PID 540 wrote to memory of 640 540 da.exe da.exe PID 540 wrote to memory of 1764 540 da.exe da.exe PID 540 wrote to memory of 1764 540 da.exe da.exe PID 540 wrote to memory of 1764 540 da.exe da.exe PID 540 wrote to memory of 1764 540 da.exe da.exe PID 540 wrote to memory of 796 540 da.exe da.exe PID 540 wrote to memory of 796 540 da.exe da.exe PID 540 wrote to memory of 796 540 da.exe da.exe PID 540 wrote to memory of 796 540 da.exe da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-59-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/540-61-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/540-62-0x00000000005C0000-0x00000000005C4000-memory.dmpFilesize
16KB
-
memory/540-63-0x00000000051D0000-0x0000000005294000-memory.dmpFilesize
784KB
-
memory/540-64-0x00000000053D0000-0x0000000005451000-memory.dmpFilesize
516KB