bb2ab6b864ce12a5df5b90ff291d5f1ef8fe2de529d986cf99ccc6272dd1e576

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
leave.exe
Size 1.9MB
Sample221126-k9lsgaba7v
SHA256 bb2ab6b864ce12a5df5b90ff291d5f1ef8fe2de529d986cf99ccc6272dd1e576
MD5 f6b975bf664efc1c5b30c4c2871c9584
SHA1 f2161747f9f824d3bd69a1e490fa34a3f8ead261
SHA512 2461e03636118b3fb5be432270c58ebd869dcff6863b63ca2192d18e14f19f84594f6ed7bc2bb328fd0a0268c325077ac371a9c413a1dc484e2c04ac84fe8c53
SSDEEP 24576:iD15Fv1SXxftJc06ElxiNtzcmamZMElFkHKN+q3OUJ:LXhtJljiNtzcmHFkHyt3OUJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 3444	1924	leave.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	leave.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83
PID 1924 wrote to memory of 3444	1924	leave.exe	83

C:\Users\Admin\AppData\Local\Temp\leave.exe
"C:\Users\Admin\AppData\Local\Temp\leave.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-132-0x00000000004C0000-0x00000000006AA000-memory.dmp

Download

memory/1924-133-0x0000000005610000-0x0000000005BB4000-memory.dmp

Download

memory/1924-134-0x0000000005060000-0x00000000050F2000-memory.dmp

Download

memory/1924-135-0x0000000005200000-0x000000000520A000-memory.dmp

Download

memory/3444-137-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3444-138-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3444-139-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3444-141-0x0000000000400000-0x0000000000448000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads