c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1

General

Target

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
Size

91KB
MD5

4bb8e8a39a8a8a591d7c653e70b4dcdc
SHA1

d14af0cc6cd83a2214d44d48483bd6e36fc2d76e
SHA256

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1
SHA512

721880a30c972a1022b3953f4ddab6c308b1d64bc6f57f152de4497b754e7075b086d06dbf580f0d1f91805633022ef736ae0c10960e7a18433936a3f7bb5c5a

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

description ioc process

File opened for modification C:\Windows\OEWABLog.txt c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

pid process

684 c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

description	ioc	process
File opened for modification	C:\Windows\OEWABLog.txt	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

pid	process
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

description pid process

Token: SeDebugPrivilege 684 c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

description	pid	process
Token: SeDebugPrivilege	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

description	pid	process	target process
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 372	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	wininit.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 384	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	csrss.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 420	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	winlogon.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 468	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	services.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 476	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsass.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 484	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	lsm.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 588	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 668	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 740	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe
PID 684 wrote to memory of 808	684	c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:808

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1044

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1124

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:872

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
"C:\Users\Admin\AppData\Local\Temp\c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-59-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing