6923309c1cf759930f67710ac9dfd328

General
Target

6923309c1cf759930f67710ac9dfd328.exe

Filesize

511KB

Completed

21-10-2021 18:48

Score
1/10
MD5

6923309c1cf759930f67710ac9dfd328

SHA1

e74291e311e8466dd7222a2eb3779848385dd3fa

SHA256

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea

Malware Config
Signatures 3

Filter: none

  • Suspicious behavior: EnumeratesProcesses
    6923309c1cf759930f67710ac9dfd328.exe

    Reported IOCs

    pidprocess
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
    14766923309c1cf759930f67710ac9dfd328.exe
  • Suspicious use of AdjustPrivilegeToken
    6923309c1cf759930f67710ac9dfd328.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege14766923309c1cf759930f67710ac9dfd328.exe
  • Suspicious use of WriteProcessMemory
    6923309c1cf759930f67710ac9dfd328.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1476 wrote to memory of 104814766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 104814766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 104814766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 104814766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 85214766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 85214766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 85214766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 85214766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 61614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 61614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 61614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 61614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 196014766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 196014766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 196014766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 196014766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 107614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 107614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 107614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
    PID 1476 wrote to memory of 107614766923309c1cf759930f67710ac9dfd328.exe6923309c1cf759930f67710ac9dfd328.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe
    "C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe
      "C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe"
      PID:1048
    • C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe
      "C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe"
      PID:852
    • C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe
      "C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe"
      PID:616
    • C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe
      "C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe"
      PID:1960
    • C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe
      "C:\Users\Admin\AppData\Local\Temp\6923309c1cf759930f67710ac9dfd328.exe"
      PID:1076
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1476-55-0x00000000003F0000-0x00000000003F1000-memory.dmp

                          • memory/1476-57-0x00000000072F0000-0x00000000072F1000-memory.dmp

                          • memory/1476-58-0x00000000003E0000-0x00000000003E7000-memory.dmp

                          • memory/1476-59-0x0000000004280000-0x00000000042CF000-memory.dmp