6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827 | Triage

Analysis

max time kernel
36s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 06:08

Sharing

Report Analysis Logs

General

Target

6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe
Size

208KB
MD5

6616fdc6dc5e338db8acd5f70448a793
SHA1

f156ef44b780a5ad7d379b9efdbba83b94e9c9c9
SHA256

6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827
SHA512

25d2fdb9c07a9031a87767e24b4f8a04b30d12e033152f7efe70edf2ed2be920ec78057630fc12821fe519ee25802a445695ed6186e81d3b404356714b00a601

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe
2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe
2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe
2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2312	2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe	57
PID 2576 wrote to memory of 2340	2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe	56
PID 2576 wrote to memory of 2424	2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe	55
PID 2576 wrote to memory of 3156	2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe	45
PID 2576 wrote to memory of 3368	2576	6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe	44

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3156

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2340

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe
"C:\Users\Admin\AppData\Local\Temp\6c816118b8a9f6a7e3a4fffdcf793b35537b58aaa05d887595629eee5bf75827.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-130-0x00007FF6CE500000-0x00007FF6CE897000-memory.dmp

Filesize
3.6MB

Download
memory/2340-131-0x00007FF6CE500000-0x00007FF6CE897000-memory.dmp

Filesize
3.6MB

Download
memory/2424-132-0x00007FF6CE500000-0x00007FF6CE897000-memory.dmp

Filesize
3.6MB

Download