3271b5bb8547e3299a52783ceda59df71b2c0b3a6d3a4a29a03a0939e841aa37

Analysis

max time kernel
145s
max time network
143s
platform
windows7_x64
resource
win7-en-20210920
submitted
09/10/2021, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
Size 1.7MB
Sample211009-jptrxafbeq
SHA256 3271b5bb8547e3299a52783ceda59df71b2c0b3a6d3a4a29a03a0939e841aa37
MD5 1a1b8dd9f38cb3ddf752e32e669cd0c1
SHA1 e9b20dd583adc4c80a9652d64a37a0cbb326f6ff
SHA512 6336e8a40c58283fbe40d65016a628e2c7e504e9e9533612296add3a83f585af93192fb547538c28134671e47d9c3714a0595d5dc27f68e873e3a19f47b8c97f
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 840 set thread context of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
Token: SeDebugPrivilege	1184	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27
PID 840 wrote to memory of 1184	840	1a1b8dd9f38cb3ddf752e32e669cd0c1.exe	27

C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
"C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
  C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-54-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/840-56-0x000000001B9B0000-0x000000001BADE000-memory.dmp

Download

memory/840-57-0x000000001BC70000-0x000000001BCE7000-memory.dmp

Download

memory/840-63-0x000000001BAF0000-0x000000001BAF2000-memory.dmp

Download

memory/1184-59-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/1184-60-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/1184-61-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/1184-58-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/1184-66-0x0000000002620000-0x00000000026A4000-memory.dmp

Download

memory/1184-67-0x000000001C1C0000-0x000000001C1C2000-memory.dmp

Download

memory/1184-68-0x0000000000960000-0x00000000009AE000-memory.dmp

Download

memory/1184-69-0x0000000000270000-0x0000000000275000-memory.dmp

Download

memory/1184-70-0x0000000000DA0000-0x0000000000DEF000-memory.dmp

Download

memory/1184-71-0x00000000027C0000-0x0000000002806000-memory.dmp

Download

memory/1184-72-0x000000001C1C6000-0x000000001C1E5000-memory.dmp

Download