00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011

General

Target
00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
Size 254KB
Sample200629-8rw4xfhdps
SHA256 00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011
MD5 6312a729c6ff4f5aa81f9aaaa5b66fbb
SHA1 ed01c5e2262c2af450886c6f71be32c9524c7729
SHA512 a82bbd8cd304cde1984d1998708f683c4c3c365bf31834cbe65339d4e8dd80d1da2c93dbc52914e548b3b6e878521181ee75758762fddd415da1d31aa64c8044
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 2144	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	66
PID 4024 wrote to memory of 2144	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	66
PID 4024 wrote to memory of 2144	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	66
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4024 wrote to memory of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	68
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	68
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	68
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	68
PID 4028 wrote to memory of 648	4028	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	68

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4024 set thread context of 4028	4024	00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe	67

C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
"C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:4024
- C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
  "{path}"
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\00a3fd22323a15f2d5b6f99683c2fb5e2736c96ad179a8d1be1a8943c811e011.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/4028-2-0x0000000000400000-0x0000000000553000-memory.dmp