Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:39
Static task
static1
Behavioral task
behavioral1
Sample
FALCOR PO .NO.FEC87257ADM20.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FALCOR PO .NO.FEC87257ADM20.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
FALCOR PO .NO.FEC87257ADM20.exe
-
Size
398KB
-
MD5
02c7ba4e15c96f667bf893f24d209e1d
-
SHA1
c14348d9407f32948b91be9d3df50862fb4ffdb9
-
SHA256
bee57d303281d0b8e2e681015ab7e1ac8c82972328c4f43350b20cc3a0999f21
-
SHA512
48d23708e14a0fbe1e7eec34436f8204e7906f62bd8cc5bc756cb3b6529aca1b8328dcf682e389fdcdf48ef8fb2b534e35a35b01fe573248d66eb64037556d5e
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
FALCOR PO .NO.FEC87257ADM20.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe FALCOR PO .NO.FEC87257ADM20.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe FALCOR PO .NO.FEC87257ADM20.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
FALCOR PO .NO.FEC87257ADM20.exepid process 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe 2392 FALCOR PO .NO.FEC87257ADM20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
FALCOR PO .NO.FEC87257ADM20.exedescription pid process Token: SeDebugPrivilege 2392 FALCOR PO .NO.FEC87257ADM20.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2392-130-0x0000000000200000-0x000000000026A000-memory.dmpFilesize
424KB
-
memory/2392-131-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/2392-132-0x00000000052A0000-0x0000000005844000-memory.dmpFilesize
5.6MB
-
memory/2392-133-0x0000000004FE0000-0x000000000507C000-memory.dmpFilesize
624KB
-
memory/2392-134-0x00000000059D0000-0x0000000005A36000-memory.dmpFilesize
408KB