6ffc8cbbd4335b8ee1487f406295eac8080bf080e0e266743166adc79a9f1950

General

Target
BL and Packing list & invoice.exe
Size 781KB
Sample220218-ssgfescfe2
SHA256 6ffc8cbbd4335b8ee1487f406295eac8080bf080e0e266743166adc79a9f1950
MD5 9a0c99f9f94eef4366fe0d74b7f73681
SHA1 8b5fb016f36d2b3015ec4d87902f7831c612ea18
SHA512 55209ca9c7400578fe06a8ae6055008ad87ff80b495d766bdd6388b1b69c06c17b5cf0bbb66a4f133461f89db67e8c7e66d52deaff0615eaa8ad18f71b6182ed
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
960	BL and Packing list & invoice.exe
960	BL and Packing list & invoice.exe
960	BL and Packing list & invoice.exe
960	BL and Packing list & invoice.exe
960	BL and Packing list & invoice.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	BL and Packing list & invoice.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 552	960	BL and Packing list & invoice.exe	27
PID 960 wrote to memory of 552	960	BL and Packing list & invoice.exe	27
PID 960 wrote to memory of 552	960	BL and Packing list & invoice.exe	27
PID 960 wrote to memory of 552	960	BL and Packing list & invoice.exe	27
PID 960 wrote to memory of 1460	960	BL and Packing list & invoice.exe	28
PID 960 wrote to memory of 1460	960	BL and Packing list & invoice.exe	28
PID 960 wrote to memory of 1460	960	BL and Packing list & invoice.exe	28
PID 960 wrote to memory of 1460	960	BL and Packing list & invoice.exe	28
PID 960 wrote to memory of 1632	960	BL and Packing list & invoice.exe	29
PID 960 wrote to memory of 1632	960	BL and Packing list & invoice.exe	29
PID 960 wrote to memory of 1632	960	BL and Packing list & invoice.exe	29
PID 960 wrote to memory of 1632	960	BL and Packing list & invoice.exe	29
PID 960 wrote to memory of 564	960	BL and Packing list & invoice.exe	30
PID 960 wrote to memory of 564	960	BL and Packing list & invoice.exe	30
PID 960 wrote to memory of 564	960	BL and Packing list & invoice.exe	30
PID 960 wrote to memory of 564	960	BL and Packing list & invoice.exe	30
PID 960 wrote to memory of 1348	960	BL and Packing list & invoice.exe	31
PID 960 wrote to memory of 1348	960	BL and Packing list & invoice.exe	31
PID 960 wrote to memory of 1348	960	BL and Packing list & invoice.exe	31
PID 960 wrote to memory of 1348	960	BL and Packing list & invoice.exe	31

C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe
"C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe"
  2⤵
  PID:552
- C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe"
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe"
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe"
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\BL and Packing list & invoice.exe"
  2⤵
  PID:1348

memory/960-55-0x0000000074CFE000-0x0000000074CFF000-memory.dmp

Download

memory/960-56-0x00000000003B0000-0x000000000047A000-memory.dmp

Download

memory/960-57-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/960-58-0x0000000000390000-0x000000000039E000-memory.dmp

Download

memory/960-59-0x00000000055A0000-0x000000000565C000-memory.dmp

Download

memory/960-60-0x0000000004140000-0x000000000417C000-memory.dmp

Download