de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a

General

Target

de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Size

31KB
MD5

39624409a0ea93b08013c35723bf0836
SHA1

1e55c57d19743d31521fd3f786b77195919644c9
SHA256

de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a
SHA512

52cb8d118df810bbecf53c98ec3e7d5e4aba35a0aafbf1acb76abbd98cfa1747116e070d52dffbd03d6b29105c129c3af1f1946b7886aa06f58ea250e8d82f6b

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe

description	pid	process
Token: SeDebugPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: 33	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
Token: SeIncBasePriorityPrivilege	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe

description	pid	process	target process
PID 976 wrote to memory of 1924	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe	netsh.exe
PID 976 wrote to memory of 1924	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe	netsh.exe
PID 976 wrote to memory of 1924	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe	netsh.exe
PID 976 wrote to memory of 1924	976	de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe
"C:\Users\Admin\AppData\Local\Temp\de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe" "de0913a5c356a8cdd5dda481dd2bf0814953704524779aa80e0c2483579e439a.exe" ENABLE
2⤵
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-54-0x00000000752D1000-0x00000000752D3000-memory.dmp

Filesize
8KB

Download
memory/976-55-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing