5ca87d23b76747cc2710bede0dd15ca05f21e1ca1df959e95aebf49304a677a0

Analysis

max time kernel
12s
max time network
162s
platform
windows10_x64
resource
win10v20210410
submitted
24/06/2021, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d949b2a7fc1633e57f1afa34cd0a90a8.exe
Size 465KB
Sample210624-djcxj3wefa
SHA256 5ca87d23b76747cc2710bede0dd15ca05f21e1ca1df959e95aebf49304a677a0
MD5 d949b2a7fc1633e57f1afa34cd0a90a8
SHA1 76b705a243bf5012be62d8789f4271e4de4b0547
SHA512 07b7eae9c5555ab25f703e0bf40b414f79322b78f049d8da9ee8d7bfdc6ab9339bad42fa572b3018b5319b74a76bec998eb18a4eed0febe22952f3b6126a4013
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

Core1 .NET packer 1 IoCs

Detects packer/loader used by .NET malware.

resource	yara_rule
behavioral2/memory/1808-119-0x000000001CF40000-0x000000001CFE7000-memory.dmp	Core1

Loads dropped DLL 1 IoCs

pid	Process
2924	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	2924	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe
1292	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1292	WerFault.exe
Token: SeBackupPrivilege	1292	WerFault.exe
Token: SeDebugPrivilege	1292	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76
PID 1808 wrote to memory of 2924	1808	d949b2a7fc1633e57f1afa34cd0a90a8.exe	76

C:\Users\Admin\AppData\Local\Temp\d949b2a7fc1633e57f1afa34cd0a90a8.exe
"C:\Users\Admin\AppData\Local\Temp\d949b2a7fc1633e57f1afa34cd0a90a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Loads dropped DLL
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 1540
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-114-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download

memory/1808-116-0x000000001C1F0000-0x000000001C2CF000-memory.dmp

Download

memory/1808-117-0x000000001C330000-0x000000001C332000-memory.dmp

Download

memory/1808-118-0x000000001D110000-0x000000001D111000-memory.dmp

Download

memory/1808-119-0x000000001CF40000-0x000000001CFE7000-memory.dmp

Download

memory/1808-120-0x0000000001050000-0x0000000001060000-memory.dmp

Download

memory/1808-121-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/1808-122-0x0000000003180000-0x0000000003210000-memory.dmp

Download

memory/2924-123-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2924-125-0x0000000000400000-0x0000000000492000-memory.dmp

Download