be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c

General

Target

be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
Size

254KB
MD5

cc095a3e639c7eb26fd4ad16bca2626c
SHA1

01ad46f4b2f4454216c9ea7fd2597b652ecfbc32
SHA256

be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c
SHA512

6ef2c97a345ced262949c5200a61adbd51c9c7735288b802d8cc337f40d158061a00d3365108f3de02b44c25dc958865b2d3b4dd050676d84bf41f8227e275e5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

description	pid	process	target process
PID 1820 set thread context of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

description	pid	process	target process
PID 1820 wrote to memory of 2120	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2120	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2120	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
PID 1820 wrote to memory of 2136	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

description pid process

Token: SeDebugPrivilege 1820 be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

description	pid	process
Token: SeDebugPrivilege	1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

pid	process
1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
1820	be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe

C:\Users\Admin\AppData\Local\Temp\be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
"C:\Users\Admin\AppData\Local\Temp\be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Users\Admin\AppData\Local\Temp\be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
"{path}"
2⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\be6f6f78c95cd6e75ce7bf0c643d3acdf6eaf68d5ed12d0bd6ff71f220c7165c.exe
"{path}"
2⤵
PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2136-1-0x0000000000405907-mapping.dmp

Download
memory/2136-2-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads