Analysis
-
max time kernel
189s -
max time network
223s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:32
Static task
static1
Behavioral task
behavioral1
Sample
INV_2020.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INV_2020.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
INV_2020.exe
-
Size
311KB
-
MD5
032e8660388186848cda8c3955f53202
-
SHA1
356a668840a4dc5fc9a209189ffed7a462c8633a
-
SHA256
24b2017e1fe4fa3f2616c1465cdb707abf300800da51ca3158580be6207876d8
-
SHA512
042ebc16e9f0c1b3ad55278b9a5f095415aef6266d3a6ce7047450fb2e3479294435ec544b7eee542427feb160cc1700c6a62babd9664fb14aa546146f4d9e30
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
INV_2020.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KulintunHost = "\"C:\\Users\\Admin\\KulintunHost.exe\"" INV_2020.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
INV_2020.exepid process 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe 2216 INV_2020.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
INV_2020.exedescription pid process Token: SeDebugPrivilege 2216 INV_2020.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-130-0x0000000000C40000-0x0000000000C94000-memory.dmpFilesize
336KB
-
memory/2216-131-0x0000000005B90000-0x0000000006134000-memory.dmpFilesize
5.6MB
-
memory/2216-132-0x0000000005680000-0x0000000005712000-memory.dmpFilesize
584KB
-
memory/2216-133-0x0000000005650000-0x000000000565A000-memory.dmpFilesize
40KB
-
memory/2216-134-0x00000000059B0000-0x0000000005A4C000-memory.dmpFilesize
624KB
-
memory/2216-135-0x00000000063B0000-0x0000000006416000-memory.dmpFilesize
408KB