b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a

General

Target
b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe
Size 3.3MB
Sample200629-ln99hkyvbx
SHA256 b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a
MD5 c8465228ad9ee338a61ebcfa838b87b2
SHA1 df49fd41e68137019b2bb1e9bd7678c0e090bea4
SHA512 21951d94bcb07e2aff706049bbc88f5956a2047785e7963446f866c07d9543bcac1718d9f34a87391c785ec50dec440a9fd28f0fcb894eb47e785ed5c2ef1cfe
MD5 SHA1 SHA512

Score

8^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe
992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1992	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	69
PID 992 wrote to memory of 1992	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	69
PID 992 wrote to memory of 1992	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	69
PID 992 wrote to memory of 2320	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	71
PID 992 wrote to memory of 2320	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	71
PID 992 wrote to memory of 2320	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	71
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73
PID 992 wrote to memory of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 2684	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe	73

Executes dropped EXE 1 IoCs

pid	Process
2684	svhostapd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	svhostapd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25fasfwwwa.exe.lnk	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderNANS\25fasfwwwa.exe:Zone.Identifier	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe
Token: 33	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe
Token: SeIncBasePriorityPrivilege	992	b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe
Token: SeDebugPrivilege	2684	svhostapd.exe

C:\Users\Admin\AppData\Local\Temp\b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe
"C:\Users\Admin\AppData\Local\Temp\b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/b0fcccae3067e57d0725eca21b6c416c9b42b26b6601a5c2d4a7dc20d72eb37a.exe" "%temp%\FolderNANS\25fasfwwwa.exe" /Y
  2⤵
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderNANS\25fasfwwwa.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\svhostapd.exe
  "C:\Users\Admin\AppData\Local\Temp\svhostapd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

memory/2684-3-0x0000000000400000-0x00000000004E8000-memory.dmp

Download