Analysis
-
max time kernel
143s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-09-2021 10:20
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
SOA.exe
-
Size
872KB
-
MD5
a3279da350cf134f736629e5e55c0a41
-
SHA1
d28cc3a2cc3e16cf38634cab8db41aacebf4709b
-
SHA256
fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
-
SHA512
248040d33716b6f7fb5c0764380c67489d2acdc52784b2d8020faa57f09edc383ab7ecd85c297ef2516698e2cfa92e7d8edc8fc0c510263e5a2b91e1f650d79b
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
SOA.exepid process 832 SOA.exe 832 SOA.exe 832 SOA.exe 832 SOA.exe 832 SOA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SOA.exedescription pid process Token: SeDebugPrivilege 832 SOA.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SOA.exedescription pid process target process PID 832 wrote to memory of 952 832 SOA.exe SOA.exe PID 832 wrote to memory of 952 832 SOA.exe SOA.exe PID 832 wrote to memory of 952 832 SOA.exe SOA.exe PID 832 wrote to memory of 952 832 SOA.exe SOA.exe PID 832 wrote to memory of 1660 832 SOA.exe SOA.exe PID 832 wrote to memory of 1660 832 SOA.exe SOA.exe PID 832 wrote to memory of 1660 832 SOA.exe SOA.exe PID 832 wrote to memory of 1660 832 SOA.exe SOA.exe PID 832 wrote to memory of 1600 832 SOA.exe SOA.exe PID 832 wrote to memory of 1600 832 SOA.exe SOA.exe PID 832 wrote to memory of 1600 832 SOA.exe SOA.exe PID 832 wrote to memory of 1600 832 SOA.exe SOA.exe PID 832 wrote to memory of 1624 832 SOA.exe SOA.exe PID 832 wrote to memory of 1624 832 SOA.exe SOA.exe PID 832 wrote to memory of 1624 832 SOA.exe SOA.exe PID 832 wrote to memory of 1624 832 SOA.exe SOA.exe PID 832 wrote to memory of 960 832 SOA.exe SOA.exe PID 832 wrote to memory of 960 832 SOA.exe SOA.exe PID 832 wrote to memory of 960 832 SOA.exe SOA.exe PID 832 wrote to memory of 960 832 SOA.exe SOA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-54-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/832-56-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/832-57-0x00000000002C0000-0x00000000002CE000-memory.dmpFilesize
56KB
-
memory/832-58-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/832-59-0x0000000005670000-0x00000000056EC000-memory.dmpFilesize
496KB
-
memory/832-60-0x00000000005F0000-0x000000000061B000-memory.dmpFilesize
172KB