85e0ff2f0c03b8d8ce1d32b446dcef0e32b79fa581a9c27dcf4d0bb92c6b167f

General

Target

uncategorized_1.2.0.0.vir.exe
Size

368KB
MD5

182bbd5dccd1470d10e6b062d39c95d7
SHA1

fc0f485b4e178293c3b3eb26c87a38172cf6ccbb
SHA256

85e0ff2f0c03b8d8ce1d32b446dcef0e32b79fa581a9c27dcf4d0bb92c6b167f
SHA512

edf99f5982240fc22d40c3bceef2f2146122bfa46806c0de320eebe8ef7631d71e4a85fdfe054dca835982adb852cfe138ff798af1341cc9dd891f8b79edfd36

Score

8^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

explorer.exeuncategorized_1.2.0.0.vir.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

uncategorized_1.2.0.0.vir.exe

description pid process

Token: SeSecurityPrivilege 3684 uncategorized_1.2.0.0.vir.exe
Token: SeSecurityPrivilege 3684 uncategorized_1.2.0.0.vir.exe

description	pid	process
Token: SeSecurityPrivilege	3684	uncategorized_1.2.0.0.vir.exe
Token: SeSecurityPrivilege	3684	uncategorized_1.2.0.0.vir.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

uncategorized_1.2.0.0.vir.exeeruki.exe

description	pid	process	target process
PID 3684 wrote to memory of 3936	3684	uncategorized_1.2.0.0.vir.exe	eruki.exe
PID 3684 wrote to memory of 3936	3684	uncategorized_1.2.0.0.vir.exe	eruki.exe
PID 3684 wrote to memory of 3936	3684	uncategorized_1.2.0.0.vir.exe	eruki.exe
PID 3936 wrote to memory of 3892	3936	eruki.exe	explorer.exe
PID 3936 wrote to memory of 3892	3936	eruki.exe	explorer.exe
PID 3936 wrote to memory of 3892	3936	eruki.exe	explorer.exe
PID 3684 wrote to memory of 1812	3684	uncategorized_1.2.0.0.vir.exe	cmd.exe
PID 3684 wrote to memory of 1812	3684	uncategorized_1.2.0.0.vir.exe	cmd.exe
PID 3684 wrote to memory of 1812	3684	uncategorized_1.2.0.0.vir.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

eruki.exe

pid process

3936 eruki.exe

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

eruki.exeexplorer.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\UNCATE~1.EXE >> NUL if exist C:\Users\Admin\AppData\Local\Temp\UNCATE~1.EXE goto repeat
2⤵
PID:1812

C:\Users\Admin\AppData\Roaming\Ofby\eruki.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Ofby\eruki.exe

Download Submit
memory/1812-8-0x0000000000000000-mapping.dmp

Download
memory/3892-5-0x0000000000000000-mapping.dmp

Download
memory/3892-6-0x0000000000E50000-0x000000000128F000-memory.dmp

Filesize
4.2MB

Download
memory/3892-7-0x0000000000E50000-0x000000000128F000-memory.dmp

Filesize
4.2MB

Download
memory/3936-1-0x0000000000000000-mapping.dmp

Download