Analysis
-
max time kernel
377s -
max time network
1702s -
platform
windows10_x64 -
resource
win10-en -
submitted
07-09-2021 18:08
General
-
Target
keygen-step-3.exe
-
Size
873KB
-
MD5
265cadde82b0c66dc39ad2d9ee800754
-
SHA1
2e9604eade6951d5a5b4a44bee1281e32166f395
-
SHA256
40fd6a0b671a0e5074a206201f57f7731a0d01baab5874b28a9b0f019a451c5a
-
SHA512
c99f3a5464e1ac02402814401c2cb66a9fafb794356395c1081bdf3c4c3534086498c19efe4055780a52a1bb80db81658c2cb4af5271015af51edf7bd3865e7b
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-3.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-3.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-3.exe" 1631038374 02⤵
- Executes dropped EXE
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 8843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\winnetdriv.exeMD5
265cadde82b0c66dc39ad2d9ee800754
SHA12e9604eade6951d5a5b4a44bee1281e32166f395
SHA25640fd6a0b671a0e5074a206201f57f7731a0d01baab5874b28a9b0f019a451c5a
SHA512c99f3a5464e1ac02402814401c2cb66a9fafb794356395c1081bdf3c4c3534086498c19efe4055780a52a1bb80db81658c2cb4af5271015af51edf7bd3865e7b
-
C:\Windows\winnetdriv.exeMD5
265cadde82b0c66dc39ad2d9ee800754
SHA12e9604eade6951d5a5b4a44bee1281e32166f395
SHA25640fd6a0b671a0e5074a206201f57f7731a0d01baab5874b28a9b0f019a451c5a
SHA512c99f3a5464e1ac02402814401c2cb66a9fafb794356395c1081bdf3c4c3534086498c19efe4055780a52a1bb80db81658c2cb4af5271015af51edf7bd3865e7b
-
memory/4156-120-0x0000000000000000-mapping.dmp
-
memory/4816-115-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB