9c0c7c19060ccc3b4fbb8303e7adc7b05230a0a8c844ca5fbdbc441fede035e4 | Triage™

Analysis

max time kernel
15s
max time network
117s
platform
windows10_x64
resource
win10v20210408
submitted
10/06/2021, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.exe
Size 1013KB
Sample210610-g8drsh2ads
SHA256 9c0c7c19060ccc3b4fbb8303e7adc7b05230a0a8c844ca5fbdbc441fede035e4
MD5 1f7a8c4b2f406d276c0d1c7d309866e6
SHA1 06bf36ff50b41ba05f1f343a21ba99600cef85a9
SHA512 d935b257cedd2982c0db02feb3978d77d01679636265723df1f1bcf9117bd8abe16eb7bfa22f049f5d6581389366a682056923de05d997d73476b8104157322b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	dw20.exe
3540	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3540	dw20.exe
Token: SeBackupPrivilege	3540	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 3540	424	PO.exe	75
PID 424 wrote to memory of 3540	424	PO.exe	75
PID 424 wrote to memory of 3540	424	PO.exe	75

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:424
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 960
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-114-0x0000000002380000-0x0000000002381000-memory.dmp

Download