Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-01-2022 10:32
Static task
static1
Behavioral task
behavioral1
Sample
SNO22 PriceLetter595406_RACX-159814.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
SNO22 PriceLetter595406_RACX-159814.exe
-
Size
373KB
-
MD5
7692a9ecc1b4d092387cffe6faa8d762
-
SHA1
37e70527d40c881115036ae2de66e3685d3a8f10
-
SHA256
22c8527c55a52f56653e38bf1f2dbc8ccc06ab0f0ab16879138f30037b710b0a
-
SHA512
e0c02c683d444ad442c1758113f875687df702402270dc7705b1b12c49e8c88e82b022f88f8d5a1767a43fdcf0f41a2bdbf281703b9dc97c322dd2cf68ff765a
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.exepid process 1588 SNO22 PriceLetter595406_RACX-159814.exe 1588 SNO22 PriceLetter595406_RACX-159814.exe 1588 SNO22 PriceLetter595406_RACX-159814.exe 1588 SNO22 PriceLetter595406_RACX-159814.exe 1588 SNO22 PriceLetter595406_RACX-159814.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.exedescription pid process Token: SeDebugPrivilege 1588 SNO22 PriceLetter595406_RACX-159814.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.exedescription pid process target process PID 1588 wrote to memory of 564 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 564 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 564 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 564 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 572 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 572 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 572 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 572 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1532 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1532 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1532 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1532 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1616 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1616 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1616 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1616 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1652 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1652 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1652 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 1588 wrote to memory of 1652 1588 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-53-0x00000000003F0000-0x0000000000454000-memory.dmpFilesize
400KB
-
memory/1588-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/1588-55-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/1588-56-0x00000000004B0000-0x00000000004BC000-memory.dmpFilesize
48KB
-
memory/1588-57-0x0000000005060000-0x00000000050BE000-memory.dmpFilesize
376KB