Analysis
- max time kernel
74s - max time network
117s - platform
windows10_x64 - resource
win10v20210408 - submitted
17/09/2021, 18:32
General
- Target Banka detayları_pdf______________________.exe
- Size 637KB
- Sample210917-w6l5lsbabl
- SHA256 5da4f819e28c2b5e768a01c4c5010f0a335a86120ddb412583a2cd716bf95356
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Banka detayları_pdf______________________.exe"C:\Users\Admin\AppData\Local\Temp\Banka detayları_pdf______________________.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 12162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmp
memory/992-116-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/992-117-0x0000000004970000-0x0000000004971000-memory.dmp
memory/992-118-0x00000000048C0000-0x0000000004DBE000-memory.dmp
memory/992-119-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/992-120-0x0000000006C20000-0x0000000006C27000-memory.dmp
memory/992-121-0x0000000006CE0000-0x0000000006CE1000-memory.dmp
memory/992-122-0x0000000007110000-0x0000000007175000-memory.dmp
memory/992-123-0x00000000072D0000-0x0000000007301000-memory.dmp