f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f

General

Target

f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe
Size

252KB
MD5

6dbce1851b656de5f49eb1d8c9786b72
SHA1

e63a7e56571b100c6acd02ba892ed35e97b35fe1
SHA256

f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f
SHA512

ab89353957f9b369b8cd3d61c64c4d3cd82a1f2e1a454d496d20c87da2b60baeb679aa803f0f50f5c1fd835992528c02f03ab5f692e1dc5ab6385ecd75e09760

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dw20.exe

description pid process

Token: SeRestorePrivilege 3360 dw20.exe
Token: SeBackupPrivilege 3360 dw20.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dw20.exe

pid process

3360 dw20.exe
3360 dw20.exe

description	pid	process
Token: SeRestorePrivilege	3360	dw20.exe
Token: SeBackupPrivilege	3360	dw20.exe

pid	process
3360	dw20.exe
3360	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe

description	pid	process	target process
PID 3236 wrote to memory of 3360	3236	f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe	dw20.exe
PID 3236 wrote to memory of 3360	3236	f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe	dw20.exe
PID 3236 wrote to memory of 3360	3236	f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe
"C:\Users\Admin\AppData\Local\Temp\f6521e298c849c14cd0a4d0e8947fa2d990e06d978e89a262e62c968cefd9b8f.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 744
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3360-0-0x0000000000000000-mapping.dmp

Download
memory/3360-1-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3360-2-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3360-3-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3360-6-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/3360-5-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-7-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-8-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-9-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-10-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-11-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-12-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-13-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-14-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-15-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-16-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-17-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-18-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-19-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-20-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-21-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-22-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-23-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-24-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-25-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-26-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-27-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-29-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-28-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-30-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-31-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-32-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-33-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-34-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-35-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-36-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-37-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-38-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-39-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-40-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-41-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-42-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-43-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3360-46-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/3360-47-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads