eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7 | Triage

Analysis

max time kernel
61s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20/02/2022, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe
Size

204KB
MD5

9c4659495814126809f7fd4b9566b124
SHA1

194877eb67fe9b160eaaa2d8a908a04d4e8c4d62
SHA256

eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7
SHA512

4e439bc0e886347194ef339aea90db6769149121cd85f4f8ca6a1f66546df5afac6de447d6cb61f1c6f484548cb1a4ad57bcd318fafb7b779889012514f7fa5d

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe
1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe
1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe
1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2316	1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe	63
PID 1620 wrote to memory of 2332	1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe	62
PID 1620 wrote to memory of 2472	1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe	29
PID 1620 wrote to memory of 2624	1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe	56
PID 1620 wrote to memory of 3220	1620	eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe	55

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2316

C:\Users\Admin\AppData\Local\Temp\eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe
"C:\Users\Admin\AppData\Local\Temp\eb603b5c296bed3b649a2aea6b76c71fbee4b7882165570e3614b4df0e8659e7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-130-0x00007FF73ECB0000-0x00007FF73EF89000-memory.dmp

Filesize
2.8MB

Download
memory/2332-131-0x00007FF73ECB0000-0x00007FF73EF89000-memory.dmp

Filesize
2.8MB

Download