a4fe9be08f2a56d9f290cd8c6d3346e4e1c08708d93e5f5f2942f748aa723e62

General

Target
f57ba4a92ab8bc274689b2b8cae95cc2.exe
Size 947KB
Sample210811-8yb38bgcss
SHA256 a4fe9be08f2a56d9f290cd8c6d3346e4e1c08708d93e5f5f2942f748aa723e62
MD5 f57ba4a92ab8bc274689b2b8cae95cc2
SHA1 f90f12002d5e685592da3d2a6507a0fb96302f53
SHA512 a39ee18f669d2f0c70910c78abc74f9e3efc84c8c2c77176b19c2196d2fecc685abd37e66946a625ac500400538f60d78c854635457d7d093362030047057706
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 468 set thread context of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 1668 wrote to memory of 468	1668	f57ba4a92ab8bc274689b2b8cae95cc2.exe	29
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31
PID 468 wrote to memory of 1064	468	f57ba4a92ab8bc274689b2b8cae95cc2.exe	31

C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
"C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
  "C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
    C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
    3⤵
    PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-71-0x0000000004910000-0x0000000004911000-memory.dmp

Download

memory/468-69-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/468-67-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1064-75-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1064-74-0x00000000768B1000-0x00000000768B3000-memory.dmp

Download

memory/1064-72-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1668-63-0x0000000004ED0000-0x0000000004F57000-memory.dmp

Download

memory/1668-66-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Download

memory/1668-65-0x0000000005340000-0x00000000053BB000-memory.dmp

Download

memory/1668-64-0x0000000000650000-0x0000000000661000-memory.dmp

Download

memory/1668-59-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/1668-62-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/1668-61-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads