472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04

General

Target

472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
Size

962KB
MD5

2d8a7a711bf1308a13f02f36ad88bf3b
SHA1

df45338383fda3fdc745c9564b76ebd84aaffe19
SHA256

472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04
SHA512

1cc23482ce5a3ae33713c1aebb6ef503d211512934d12b873ba86d140f9d042dbbd1544aa399b5fefa5a371e24209a21f5994146d7cda9c5ffc63c4b0005b74a

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe

pid	Process
1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe

description	pid	Process
Token: SeDebugPrivilege	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe

description	pid	Process	procid_target
PID 1732 wrote to memory of 1988	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	28
PID 1732 wrote to memory of 1988	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	28
PID 1732 wrote to memory of 1988	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	28
PID 1732 wrote to memory of 1988	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	28
PID 1732 wrote to memory of 828	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	29
PID 1732 wrote to memory of 828	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	29
PID 1732 wrote to memory of 828	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	29
PID 1732 wrote to memory of 828	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	29
PID 1732 wrote to memory of 1204	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	30
PID 1732 wrote to memory of 1204	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	30
PID 1732 wrote to memory of 1204	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	30
PID 1732 wrote to memory of 1204	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	30
PID 1732 wrote to memory of 1716	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	31
PID 1732 wrote to memory of 1716	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	31
PID 1732 wrote to memory of 1716	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	31
PID 1732 wrote to memory of 1716	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	31
PID 1732 wrote to memory of 2032	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	32
PID 1732 wrote to memory of 2032	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	32
PID 1732 wrote to memory of 2032	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	32
PID 1732 wrote to memory of 2032	1732	472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe	32

C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
"C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
  "C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe"
  2⤵
  PID:1988
- C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
  "C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe"
  2⤵
  PID:828
- C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
  "C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe"
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
  "C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe"
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe
  "C:\Users\Admin\AppData\Local\Temp\472b8091593a2fef317573e75d7bd424ba67b164c0aaaa06c26de6b15d19bb04.exe"
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000000370000-0x0000000000466000-memory.dmp

Filesize
984KB

Download
memory/1732-55-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/1732-56-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads