85ab9958e4dc3181a12de70b84ee73789083a374b687434edc9c8bc6cb4f8c2c | Triage

Analysis

max time kernel
26s
max time network
145s
platform
windows10_x64
resource
win10v20210410
submitted
16-07-2021 11:20

Sharing

Report Analysis Logs

General

Target

Twitch Monster/TwitchBotByBigSmokeKurva.dll.exe
Size

66KB
MD5

247f7c37f65e8d0ea578f13b3a244b65
SHA1

1e90cc700591861de65e1f6ec12b4968750bfe95
SHA256

9cee60fcab6e7445e04ecff537ddc875d3c0959ed9a37374a75f0e56553c56a2
SHA512

0a42fccd0d297335552884cd95d3da2f4e074012556e786b35812dd2a44211b4154c0c1e163b03c4d4dfad844fc5ad4734081bcb4488d4becac5d08e84e0bf77

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2404 3196 WerFault.exe TwitchBotByBigSmokeKurva.dll.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe
2404	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2404 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Twitch Monster\TwitchBotByBigSmokeKurva.dll.exe
"C:\Users\Admin\AppData\Local\Temp\Twitch Monster\TwitchBotByBigSmokeKurva.dll.exe"
1⤵
PID:3196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3196 -s 688
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-117-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download