9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5

General

Target

9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
Size

448KB
MD5

d06fef9cf7c5f43fad88091d0a3748b4
SHA1

2abdb8a55d14c8ca00ae4f121cc9ebb5fc504ce3
SHA256

9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5
SHA512

bfedf0ca28dec1df18064c13c7868fb85192c9087ad20db0ba86dc5570145669c0c8874dd5ae0d72bd83470ec1341c94477201b025328cbfa056b39084a0d361

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1564	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	29
PID 1640 wrote to memory of 1564	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	29
PID 1640 wrote to memory of 1564	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	29
PID 1640 wrote to memory of 1564	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	29
PID 1640 wrote to memory of 1972	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	30
PID 1640 wrote to memory of 1972	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	30
PID 1640 wrote to memory of 1972	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	30
PID 1640 wrote to memory of 1972	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	30
PID 1640 wrote to memory of 1720	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	31
PID 1640 wrote to memory of 1720	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	31
PID 1640 wrote to memory of 1720	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	31
PID 1640 wrote to memory of 1720	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	31
PID 1640 wrote to memory of 2020	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	32
PID 1640 wrote to memory of 2020	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	32
PID 1640 wrote to memory of 2020	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	32
PID 1640 wrote to memory of 2020	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	32
PID 1640 wrote to memory of 2024	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	33
PID 1640 wrote to memory of 2024	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	33
PID 1640 wrote to memory of 2024	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	33
PID 1640 wrote to memory of 2024	1640	9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe	33

C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
"C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
  "{path}"
  2⤵
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
  "{path}"
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
  "{path}"
  2⤵
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
  "{path}"
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5.exe
  "{path}"
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-54-0x0000000000280000-0x00000000002F6000-memory.dmp

Filesize
472KB

Download
memory/1640-55-0x0000000001EE0000-0x0000000001EFE000-memory.dmp

Filesize
120KB

Download
memory/1640-56-0x0000000004ED0000-0x0000000004F1A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads