Analysis
-
max time kernel
88s -
max time network
91s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 05:49
Static task
static1
Behavioral task
behavioral1
Sample
905f74fb158b50341e6dc710a60dad37.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
905f74fb158b50341e6dc710a60dad37.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
905f74fb158b50341e6dc710a60dad37.exe
-
Size
11KB
-
MD5
905f74fb158b50341e6dc710a60dad37
-
SHA1
b54645bb347a4c76d73f2ff0e46aa4bd9b010ae0
-
SHA256
e2be9c91435869a3115459dccf4bd7f39c7da19e2b8ef43979b6a234c6c73335
-
SHA512
930d2133a759bbb634d9cb2860dbc7ce03215d68ea46d396d6eb1d6484c5a2104bec21a0d873e831f1f5f218e1fa44c1dbaef57fdf27fb8b66e57bea929abcf7
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
905f74fb158b50341e6dc710a60dad37.exepid process 3492 905f74fb158b50341e6dc710a60dad37.exe 3492 905f74fb158b50341e6dc710a60dad37.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
905f74fb158b50341e6dc710a60dad37.exedescription pid process Token: SeDebugPrivilege 3492 905f74fb158b50341e6dc710a60dad37.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
905f74fb158b50341e6dc710a60dad37.exedescription pid process target process PID 3492 wrote to memory of 784 3492 905f74fb158b50341e6dc710a60dad37.exe RegAsm.exe PID 3492 wrote to memory of 784 3492 905f74fb158b50341e6dc710a60dad37.exe RegAsm.exe PID 3492 wrote to memory of 784 3492 905f74fb158b50341e6dc710a60dad37.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\905f74fb158b50341e6dc710a60dad37.exe"C:\Users\Admin\AppData\Local\Temp\905f74fb158b50341e6dc710a60dad37.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3492-114-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/3492-116-0x0000000002650000-0x0000000002652000-memory.dmpFilesize
8KB
-
memory/3492-117-0x0000000000CC0000-0x0000000000D25000-memory.dmpFilesize
404KB
-
memory/3492-118-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB