Analysis
- max time kernel
33s - max time network
45s - platform
windows7_x64 - resource
win7v20210408 - submitted
09/08/2021, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
B490CB2051120FAE80AF8E0474F240C0.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target B490CB2051120FAE80AF8E0474F240C0.exe
- Size 2.1MB
- Sample210809-emymj7jsts
- SHA256 870529ce8a6938063220619a4635b6bde6bf9bc18cc735a0157bc4ea24187ac4
- MD5 b490cb2051120fae80af8e0474f240c0
- SHA1 86fa25338ff3a67671290f5736e5bee3aaf08f4d
- SHA512 2e99eedcbcefc2283eee86aff1d6b857da733b2f367a584707ae71fb67d2bd955a908e50f34b779264f914d99bf10db3f8c834dabce567aa3afedbac0ca79ff2
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdtc = "\"C:\\Users\\Admin\\AppData\\Local\\msdtc.exe\"" B490CB2051120FAE80AF8E0474F240C0.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe 320 B490CB2051120FAE80AF8E0474F240C0.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 320 B490CB2051120FAE80AF8E0474F240C0.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 320 wrote to memory of 556 320 B490CB2051120FAE80AF8E0474F240C0.exe 29 PID 320 wrote to memory of 556 320 B490CB2051120FAE80AF8E0474F240C0.exe 29 PID 320 wrote to memory of 556 320 B490CB2051120FAE80AF8E0474F240C0.exe 29 PID 320 wrote to memory of 556 320 B490CB2051120FAE80AF8E0474F240C0.exe 29 PID 320 wrote to memory of 1520 320 B490CB2051120FAE80AF8E0474F240C0.exe 30 PID 320 wrote to memory of 1520 320 B490CB2051120FAE80AF8E0474F240C0.exe 30 PID 320 wrote to memory of 1520 320 B490CB2051120FAE80AF8E0474F240C0.exe 30 PID 320 wrote to memory of 1520 320 B490CB2051120FAE80AF8E0474F240C0.exe 30 PID 320 wrote to memory of 784 320 B490CB2051120FAE80AF8E0474F240C0.exe 31 PID 320 wrote to memory of 784 320 B490CB2051120FAE80AF8E0474F240C0.exe 31 PID 320 wrote to memory of 784 320 B490CB2051120FAE80AF8E0474F240C0.exe 31 PID 320 wrote to memory of 784 320 B490CB2051120FAE80AF8E0474F240C0.exe 31 PID 320 wrote to memory of 1452 320 B490CB2051120FAE80AF8E0474F240C0.exe 32 PID 320 wrote to memory of 1452 320 B490CB2051120FAE80AF8E0474F240C0.exe 32 PID 320 wrote to memory of 1452 320 B490CB2051120FAE80AF8E0474F240C0.exe 32 PID 320 wrote to memory of 1452 320 B490CB2051120FAE80AF8E0474F240C0.exe 32 PID 320 wrote to memory of 456 320 B490CB2051120FAE80AF8E0474F240C0.exe 33 PID 320 wrote to memory of 456 320 B490CB2051120FAE80AF8E0474F240C0.exe 33 PID 320 wrote to memory of 456 320 B490CB2051120FAE80AF8E0474F240C0.exe 33 PID 320 wrote to memory of 456 320 B490CB2051120FAE80AF8E0474F240C0.exe 33 PID 320 wrote to memory of 1576 320 B490CB2051120FAE80AF8E0474F240C0.exe 34 PID 320 wrote to memory of 1576 320 B490CB2051120FAE80AF8E0474F240C0.exe 34 PID 320 wrote to memory of 1576 320 B490CB2051120FAE80AF8E0474F240C0.exe 34 PID 320 wrote to memory of 1576 320 B490CB2051120FAE80AF8E0474F240C0.exe 34 PID 320 wrote to memory of 1108 320 B490CB2051120FAE80AF8E0474F240C0.exe 35 PID 320 wrote to memory of 1108 320 B490CB2051120FAE80AF8E0474F240C0.exe 35 PID 320 wrote to memory of 1108 320 B490CB2051120FAE80AF8E0474F240C0.exe 35 PID 320 wrote to memory of 1108 320 B490CB2051120FAE80AF8E0474F240C0.exe 35 PID 320 wrote to memory of 1288 320 B490CB2051120FAE80AF8E0474F240C0.exe 36 PID 320 wrote to memory of 1288 320 B490CB2051120FAE80AF8E0474F240C0.exe 36 PID 320 wrote to memory of 1288 320 B490CB2051120FAE80AF8E0474F240C0.exe 36 PID 320 wrote to memory of 1288 320 B490CB2051120FAE80AF8E0474F240C0.exe 36 PID 320 wrote to memory of 300 320 B490CB2051120FAE80AF8E0474F240C0.exe 37 PID 320 wrote to memory of 300 320 B490CB2051120FAE80AF8E0474F240C0.exe 37 PID 320 wrote to memory of 300 320 B490CB2051120FAE80AF8E0474F240C0.exe 37 PID 320 wrote to memory of 300 320 B490CB2051120FAE80AF8E0474F240C0.exe 37 PID 320 wrote to memory of 1628 320 B490CB2051120FAE80AF8E0474F240C0.exe 38 PID 320 wrote to memory of 1628 320 B490CB2051120FAE80AF8E0474F240C0.exe 38 PID 320 wrote to memory of 1628 320 B490CB2051120FAE80AF8E0474F240C0.exe 38 PID 320 wrote to memory of 1628 320 B490CB2051120FAE80AF8E0474F240C0.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe"C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:784
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:456
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:300
-
-
C:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exeC:\Users\Admin\AppData\Local\Temp\B490CB2051120FAE80AF8E0474F240C0.exe2⤵PID:1628
-