Analysis
- max time kernel
148s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
07/07/2021, 15:48
General
- Target 804aebd67b3661d6ab370f8c524da199.exe
- Size 528KB
- Sample210707-3kdnwsbe4a
- SHA256 fd110cb1dd9a7cabdb7ef29dc7d7b7bf9a24433115723031669e4dfeaf1eb76c
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\804aebd67b3661d6ab370f8c524da199.exe"C:\Users\Admin\AppData\Local\Temp\804aebd67b3661d6ab370f8c524da199.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\804aebd67b3661d6ab370f8c524da199.exeC:\Users\Admin\AppData\Local\Temp\804aebd67b3661d6ab370f8c524da199.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\804aebd67b3661d6ab370f8c524da199.exeC:\Users\Admin\AppData\Local\Temp\804aebd67b3661d6ab370f8c524da199.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1092-126-0x0000000000400000-0x000000000047C000-memory.dmp
memory/1092-135-0x0000000006370000-0x0000000006371000-memory.dmp
memory/1092-134-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/1092-133-0x0000000005700000-0x0000000005701000-memory.dmp
memory/1092-132-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/3920-118-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/3920-125-0x00000000075D0000-0x000000000762E000-memory.dmp
memory/3920-120-0x0000000005C70000-0x0000000005CDB000-memory.dmp
memory/3920-119-0x0000000005740000-0x00000000057D2000-memory.dmp
memory/3920-114-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/3920-117-0x0000000005810000-0x0000000005811000-memory.dmp
memory/3920-116-0x0000000005D10000-0x0000000005D11000-memory.dmp