Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 22:41
Behavioral task
behavioral1
Sample
9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe
-
Size
69KB
-
MD5
82008b605cb87eddd484c18ee9c35f03
-
SHA1
b6688552db53bdcfb6f6eec48d9fb7a953ef2a18
-
SHA256
9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a
-
SHA512
6c749b4d9f005e2b13b5440a0a78bd3a6be2e0381b2231028a815c442a5f9a574bbe50acbb302e70df3d545dad6ca1a61799b3993f3c4fdf8b345af5818a5e06
Malware Config
Signatures
-
suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
-
suricata: ET MALWARE Win32/BlackNET CnC Requesting Command
suricata: ET MALWARE Win32/BlackNET CnC Requesting Command
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exepid process 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exedescription pid process Token: SeDebugPrivilege 2208 9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe"C:\Users\Admin\AppData\Local\Temp\9256e208fd02f0fc05a257e4ec61931fbefc30aafb530fceb150272131c1221a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2208-130-0x00007FFB68300000-0x00007FFB68D36000-memory.dmpFilesize
10.2MB