00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011

General

Target

00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
Size

254KB
MD5

6312a729c6ff4f5aa81f9aaaa5b66fbb
SHA1

ed01c5e2262c2af450886c6f71be32c9524c7729
SHA256

00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011
SHA512

a82bbd8cd304cde1984d1998708f683c4c3c365bf31834cbe65339d4e8dd80d1da2c93dbc52914e548b3b6e878521181ee75758762fddd415da1d31aa64c8044

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

description pid process

Token: SeDebugPrivilege 4024 00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

description	pid	process
Token: SeDebugPrivilege	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

pid	process
4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

description	pid	process	target process
PID 4024 set thread context of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
"C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:4024

C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
"{path}"
2⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-3-0x0000000000000000-mapping.dmp

Download
memory/648-4-0x0000000000000000-mapping.dmp

Download
memory/4028-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/4028-1-0x0000000000405907-mapping.dmp

Download
memory/4028-2-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

description	pid	process	target process
PID 4024 wrote to memory of 2144	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 2144	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 2144	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	cmd.exe
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	cmd.exe
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	cmd.exe
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	cmd.exe
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	cmd.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads