ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a

General

Target
f8f5b3bad883e0b62fed5af138449db6.exe
Size 727KB
Sample210702-aecdpgyees
SHA256 ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a
MD5 f8f5b3bad883e0b62fed5af138449db6
SHA1 a09c250244420c43e83433d2a54a784b1400417a
SHA512 bf325530600b0211039872b5a7b1796c5f802d7eaeaac66b5ca1b92d5b3f2db3f5776fe453cdf2f7e6434fc36b7a8bbe035566036244209cfab546ec514b36c3
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe
4048	f8f5b3bad883e0b62fed5af138449db6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	f8f5b3bad883e0b62fed5af138449db6.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2732	4048	f8f5b3bad883e0b62fed5af138449db6.exe	77
PID 4048 wrote to memory of 2732	4048	f8f5b3bad883e0b62fed5af138449db6.exe	77
PID 4048 wrote to memory of 2732	4048	f8f5b3bad883e0b62fed5af138449db6.exe	77
PID 4048 wrote to memory of 2932	4048	f8f5b3bad883e0b62fed5af138449db6.exe	78
PID 4048 wrote to memory of 2932	4048	f8f5b3bad883e0b62fed5af138449db6.exe	78
PID 4048 wrote to memory of 2932	4048	f8f5b3bad883e0b62fed5af138449db6.exe	78
PID 4048 wrote to memory of 3616	4048	f8f5b3bad883e0b62fed5af138449db6.exe	79
PID 4048 wrote to memory of 3616	4048	f8f5b3bad883e0b62fed5af138449db6.exe	79
PID 4048 wrote to memory of 3616	4048	f8f5b3bad883e0b62fed5af138449db6.exe	79
PID 4048 wrote to memory of 1248	4048	f8f5b3bad883e0b62fed5af138449db6.exe	80
PID 4048 wrote to memory of 1248	4048	f8f5b3bad883e0b62fed5af138449db6.exe	80
PID 4048 wrote to memory of 1248	4048	f8f5b3bad883e0b62fed5af138449db6.exe	80
PID 4048 wrote to memory of 1092	4048	f8f5b3bad883e0b62fed5af138449db6.exe	81
PID 4048 wrote to memory of 1092	4048	f8f5b3bad883e0b62fed5af138449db6.exe	81
PID 4048 wrote to memory of 1092	4048	f8f5b3bad883e0b62fed5af138449db6.exe	81

C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
"C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
  "C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
  "C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
  "C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
  2⤵
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
  "C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
  2⤵
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
  "C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
  2⤵
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4048-114-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/4048-116-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/4048-117-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/4048-118-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/4048-119-0x00000000050E0000-0x00000000050E1000-memory.dmp

Download

memory/4048-120-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/4048-121-0x00000000051A0000-0x000000000569E000-memory.dmp

Download

memory/4048-122-0x0000000009370000-0x000000000B36F000-memory.dmp

Download

memory/4048-123-0x000000000B6B0000-0x000000000B712000-memory.dmp

Download

memory/4048-124-0x000000000B720000-0x000000000B74A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads