Analysis
-
max time kernel
127s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 23:30
Static task
static1
Behavioral task
behavioral1
Sample
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe
Resource
win10v2004-20220414-en
General
-
Target
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe
-
Size
1.4MB
-
MD5
821769527b184bdc553c49a114feae97
-
SHA1
7363adbd9290aaf84ebbf2dd1a5c0f1b13a01e7c
-
SHA256
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433
-
SHA512
d660960cca6102686618554197cb9b1f50657f5acff35dbc2fe42a0f05f787ca46d6c1dd27ed158b612d241da54c442c692c0fa39901fd921753fc47b943b992
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exedescription pid process target process PID 1196 set thread context of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exepowershell.exepid process 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 1116 powershell.exe 1116 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exepowershell.exedescription pid process Token: SeDebugPrivilege 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe Token: SeDebugPrivilege 540 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe Token: SeDebugPrivilege 1116 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.execmd.exedescription pid process target process PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 1196 wrote to memory of 540 1196 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe PID 540 wrote to memory of 1624 540 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe cmd.exe PID 540 wrote to memory of 1624 540 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe cmd.exe PID 540 wrote to memory of 1624 540 3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe cmd.exe PID 1624 wrote to memory of 1116 1624 cmd.exe powershell.exe PID 1624 wrote to memory of 1116 1624 cmd.exe powershell.exe PID 1624 wrote to memory of 1116 1624 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe"C:\Users\Admin\AppData\Local\Temp\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe"C:\Users\Admin\AppData\Local\Temp\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3a47baed5678bc0b96f23641c4bd0ca1585f393979b7dd3072aad6fe03c2a433.exe.logFilesize
1KB
MD571046d1530f298c0f55f880d0f30ea44
SHA1b33ec4723e78d04d7f3cd34a372a7be90f17cc41
SHA256cbaf7ccaf1640247cbcdd0190057e10bde45902d35ab2b88565af421faca34a7
SHA512dceeeba0317ad00b20ddbc50887c7966278b4a2d8aafa42fd74c9c2c1528178e7c4164cb7fcd03552958088f2b34b38a834acf0ac97eb34273bc50135b8bb27d
-
memory/540-181-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-141-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-179-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-139-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-177-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-143-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-145-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-147-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-149-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-151-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-153-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-155-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-159-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-165-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-173-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-175-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-187-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-185-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-195-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-197-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-193-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-191-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-189-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-134-0x0000000000000000-mapping.dmp
-
memory/540-137-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-135-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-183-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-171-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-169-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-167-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-163-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-161-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-157-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/540-644-0x0000000005150000-0x00000000051EC000-memory.dmpFilesize
624KB
-
memory/540-645-0x0000000005D80000-0x0000000005DE6000-memory.dmpFilesize
408KB
-
memory/1116-648-0x0000000000000000-mapping.dmp
-
memory/1116-653-0x00000000067F0000-0x000000000680E000-memory.dmpFilesize
120KB
-
memory/1116-657-0x00000000077C0000-0x00000000077E2000-memory.dmpFilesize
136KB
-
memory/1116-650-0x00000000059B0000-0x0000000005FD8000-memory.dmpFilesize
6.2MB
-
memory/1116-656-0x0000000007860000-0x00000000078F6000-memory.dmpFilesize
600KB
-
memory/1116-655-0x0000000006CF0000-0x0000000006D0A000-memory.dmpFilesize
104KB
-
memory/1116-654-0x0000000007E40000-0x00000000084BA000-memory.dmpFilesize
6.5MB
-
memory/1116-652-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/1116-649-0x0000000005230000-0x0000000005266000-memory.dmpFilesize
216KB
-
memory/1116-651-0x0000000005850000-0x0000000005872000-memory.dmpFilesize
136KB
-
memory/1196-133-0x00000000071B0000-0x00000000071F4000-memory.dmpFilesize
272KB
-
memory/1196-131-0x0000000006300000-0x00000000068A4000-memory.dmpFilesize
5.6MB
-
memory/1196-130-0x0000000000A10000-0x0000000000B78000-memory.dmpFilesize
1.4MB
-
memory/1196-132-0x0000000005E40000-0x0000000005ED2000-memory.dmpFilesize
584KB
-
memory/1624-646-0x0000000000000000-mapping.dmp