0ea5f38a33714a857aa46a7dd180fd85fea2e0eb1e919671d13b2fb5cae5296e | Triage

Analysis

max time kernel
120s
max time network
172s
platform
windows7_x64
resource
win7v20210410
submitted
21-07-2021 13:31

Sharing

Report Analysis Logs

General

Target

JMIRLlEMHBPEEQvrxjqCV.exe
Size

215KB
MD5

fd759dd1bc9fd7410275b3241e033056
SHA1

1b54a28e2733bb327613d9b28faf52bd03cecefe
SHA256

0ea5f38a33714a857aa46a7dd180fd85fea2e0eb1e919671d13b2fb5cae5296e
SHA512

cea6f4ec2f522d3ff09b87d04aa007bed81270eb99be443e35d32a52b00f781a57594e0b9a9cb1bd3721156e3acf9c7ba9c9f3113e55aaca1997c2bbd9e41221

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

JMIRLlEMHBPEEQvrxjqCV.exe

pid process

1032 JMIRLlEMHBPEEQvrxjqCV.exe
1032 JMIRLlEMHBPEEQvrxjqCV.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1284 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

JMIRLlEMHBPEEQvrxjqCV.exe

description pid process

Token: SeDebugPrivilege 1032 JMIRLlEMHBPEEQvrxjqCV.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

JMIRLlEMHBPEEQvrxjqCV.exe

description	pid	process	target process
PID 1032 wrote to memory of 1284	1032	JMIRLlEMHBPEEQvrxjqCV.exe	dw20.exe
PID 1032 wrote to memory of 1284	1032	JMIRLlEMHBPEEQvrxjqCV.exe	dw20.exe
PID 1032 wrote to memory of 1284	1032	JMIRLlEMHBPEEQvrxjqCV.exe	dw20.exe
PID 1032 wrote to memory of 1284	1032	JMIRLlEMHBPEEQvrxjqCV.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\JMIRLlEMHBPEEQvrxjqCV.exe
"C:\Users\Admin\AppData\Local\Temp\JMIRLlEMHBPEEQvrxjqCV.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 516
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-60-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1032-61-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/1284-62-0x0000000000000000-mapping.dmp

Download
memory/1284-64-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download