Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-05-2020 10:16
General
-
Target
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
-
Size
88KB
-
MD5
a4e1caab1b9642ef645b6549ca09d303
-
SHA1
da0cd782f32088c0df8cd62deda1c61b4cedd6fb
-
SHA256
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3
-
SHA512
7bfac7c52b00928a28dbcdf73f50401e1be2177540c7473de20f8058e49f46eb6d508eb9eac090c2b25d61e507e839da1404b4da3f66fc10e54797023d7659ae
Score
6/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger