Analysis
- max time kernel
141s - max time network
145s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/10/2021, 07:51
General
- Target 1a1b8dd9f38cb3ddf752e32e669cd0c1.exe
- Size 1.7MB
- Sample211009-jptrxafbeq
- SHA256 3271b5bb8547e3299a52783ceda59df71b2c0b3a6d3a4a29a03a0939e841aa37
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe"C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exeC:\Users\Admin\AppData\Local\Temp\1a1b8dd9f38cb3ddf752e32e669cd0c1.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1032-118-0x0000000001240000-0x00000000012B7000-memory.dmp
memory/1032-117-0x00000000009E0000-0x00000000009E2000-memory.dmp
memory/1032-114-0x0000000000700000-0x0000000000701000-memory.dmp
memory/1032-116-0x000000001C470000-0x000000001C59E000-memory.dmp
memory/1624-119-0x0000000140000000-0x0000000140070000-memory.dmp
memory/1624-124-0x0000000002DD0000-0x0000000002E54000-memory.dmp
memory/1624-125-0x0000000002F10000-0x0000000002F12000-memory.dmp
memory/1624-126-0x0000000000DC0000-0x0000000000E0E000-memory.dmp
memory/1624-127-0x0000000000AF0000-0x0000000000AF5000-memory.dmp
memory/1624-128-0x0000000002E60000-0x0000000002EAF000-memory.dmp
memory/1624-129-0x0000000002EB0000-0x0000000002EF6000-memory.dmp
memory/1624-130-0x0000000002F12000-0x0000000002F14000-memory.dmp