Analysis
-
max time kernel
144s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-09-2021 19:05
Static task
static1
Behavioral task
behavioral1
Sample
UPDATED e-STATEMENT..exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
UPDATED e-STATEMENT..exe
-
Size
872KB
-
MD5
a3279da350cf134f736629e5e55c0a41
-
SHA1
d28cc3a2cc3e16cf38634cab8db41aacebf4709b
-
SHA256
fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
-
SHA512
248040d33716b6f7fb5c0764380c67489d2acdc52784b2d8020faa57f09edc383ab7ecd85c297ef2516698e2cfa92e7d8edc8fc0c510263e5a2b91e1f650d79b
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
UPDATED e-STATEMENT..exepid process 2044 UPDATED e-STATEMENT..exe 2044 UPDATED e-STATEMENT..exe 2044 UPDATED e-STATEMENT..exe 2044 UPDATED e-STATEMENT..exe 2044 UPDATED e-STATEMENT..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
UPDATED e-STATEMENT..exedescription pid process Token: SeDebugPrivilege 2044 UPDATED e-STATEMENT..exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
UPDATED e-STATEMENT..exedescription pid process target process PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1552 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1944 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1752 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 1300 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe PID 2044 wrote to memory of 516 2044 UPDATED e-STATEMENT..exe UPDATED e-STATEMENT..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2044-54-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2044-56-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/2044-57-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/2044-58-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/2044-59-0x0000000005BE0000-0x0000000005C5C000-memory.dmpFilesize
496KB
-
memory/2044-60-0x0000000000730000-0x000000000075B000-memory.dmpFilesize
172KB