Analysis
- max time kernel
139s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/05/2022, 00:58
General
- Target Yeni belge 2020-08-20 11.04.05.exe
- Size 849KB
- Sample220521-bbkcbaeffk
- SHA256 ab5b1c3d9e87aacfe6b37cc962e80a62a3acef7eddcdca78649eda365c04fa45
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yeni belge 2020-08-20 11.04.05.exe"C:\Users\Admin\AppData\Local\Temp\Yeni belge 2020-08-20 11.04.05.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Yeni belge 2020-08-20 11.04.05.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Yeni belge 2020-08-20 11.04.05.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Yeni belge 2020-08-20 11.04.05.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Yeni belge 2020-08-20 11.04.05.exe.log
memory/784-137-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/784-136-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1148-144-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/1148-149-0x0000000006DD0000-0x0000000006DF2000-memory.dmp
memory/1148-148-0x0000000007850000-0x00000000078E6000-memory.dmp
memory/1148-147-0x0000000006D00000-0x0000000006D1A000-memory.dmp
memory/1148-146-0x0000000007ED0000-0x000000000854A000-memory.dmp
memory/1148-145-0x0000000006880000-0x000000000689E000-memory.dmp
memory/1148-141-0x0000000002E70000-0x0000000002EA6000-memory.dmp
memory/1148-142-0x0000000005A50000-0x0000000006078000-memory.dmp
memory/1148-143-0x00000000057F0000-0x0000000005812000-memory.dmp
memory/4076-134-0x0000000009970000-0x0000000009A0C000-memory.dmp
memory/4076-130-0x00000000004A0000-0x000000000057A000-memory.dmp
memory/4076-131-0x0000000007950000-0x0000000007EF4000-memory.dmp
memory/4076-132-0x0000000007440000-0x00000000074D2000-memory.dmp
memory/4076-133-0x0000000007400000-0x000000000740A000-memory.dmp