c08281aad469530583f8216b4e4fa73c2f94807b680ae7407662ea08641dc8e1 | Triage™

Analysis

max time kernel
121s
max time network
130s
platform
windows10_x64
resource
win10-en-20211208
submitted
25/01/2022, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35a4dbe8fc377c105e08f9a500a22569.exe
Size 417KB
Sample220125-mjvc2aecc5
SHA256 c08281aad469530583f8216b4e4fa73c2f94807b680ae7407662ea08641dc8e1
MD5 35a4dbe8fc377c105e08f9a500a22569
SHA1 46f5ac2b51916112f2a941294fd78ab10bdf5ace
SHA512 eea1c051bbcd223f4ab5daba7c59a9ee81edb27cdd1f26b7248d28ab8c5d5ab889fcf0ac79cae9d0e59689aa5da475cff2aad6aebf38ea0d9066944c0ead0d8c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2512	dw20.exe
2512	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2512	dw20.exe
Token: SeBackupPrivilege	2512	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 2512	680	35a4dbe8fc377c105e08f9a500a22569.exe	69
PID 680 wrote to memory of 2512	680	35a4dbe8fc377c105e08f9a500a22569.exe	69
PID 680 wrote to memory of 2512	680	35a4dbe8fc377c105e08f9a500a22569.exe	69

C:\Users\Admin\AppData\Local\Temp\35a4dbe8fc377c105e08f9a500a22569.exe
"C:\Users\Admin\AppData\Local\Temp\35a4dbe8fc377c105e08f9a500a22569.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 892
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-115-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download