Analysis

  • max time kernel
    67s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-05-2022 18:09

General

  • Target

    01c29ab258383c8b48f343ce8b44cf5f53b6cb26639f8d6d7e34b18aa36df05d.exe

  • Size

    1.0MB

  • MD5

    4002f13fec49ba4f432fc392f8555fc7

  • SHA1

    213376d1aed9b6d047dc40f84f8926893519da57

  • SHA256

    01c29ab258383c8b48f343ce8b44cf5f53b6cb26639f8d6d7e34b18aa36df05d

  • SHA512

    7dec5162c35af3f39dcb837eb6a465d68ad0471dc3c4e8f99aba015b9d2f0055e3c45315d5a343a64c24ffcfcd1506de50927759114dcc54e4a384d47dc8e6d6

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01c29ab258383c8b48f343ce8b44cf5f53b6cb26639f8d6d7e34b18aa36df05d.exe
    "C:\Users\Admin\AppData\Local\Temp\01c29ab258383c8b48f343ce8b44cf5f53b6cb26639f8d6d7e34b18aa36df05d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
        PID:1648

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1612-54-0x0000000076531000-0x0000000076533000-memory.dmp

      Filesize

      8KB

    • memory/1612-55-0x0000000074AE0000-0x000000007508B000-memory.dmp

      Filesize

      5.7MB

    • memory/1648-56-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-64-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-66-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-62-0x000000000048B20E-mapping.dmp

    • memory/1648-61-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-60-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-59-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-57-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1648-68-0x0000000074AE0000-0x000000007508B000-memory.dmp

      Filesize

      5.7MB