50e7bc3f1330706bc86c60422c18a43260ef4b80dbcd24e2d0c2519bf17a1519

General

Target

AWB# 1022355167633.exe
Size

604KB
MD5

4f3335711a4ba3c9aaadae174d94983f
SHA1

16838645a3496c7d772f2e6aa0551e4969a019aa
SHA256

50e7bc3f1330706bc86c60422c18a43260ef4b80dbcd24e2d0c2519bf17a1519
SHA512

e2e3b2c86cfe04eb8323cff2476d39e4a2ec6650e3a8fbe53ab8263789c675937499a47b7b9edf4fdf4f4d07aa39249ccc540c3a180703ba6957b31570cc4555

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

AWB# 1022355167633.exe

pid process

1624 AWB# 1022355167633.exe
1624 AWB# 1022355167633.exe
1624 AWB# 1022355167633.exe
1624 AWB# 1022355167633.exe
1624 AWB# 1022355167633.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AWB# 1022355167633.exe

description pid process

Token: SeDebugPrivilege 1624 AWB# 1022355167633.exe

pid	process
1624	AWB# 1022355167633.exe
1624	AWB# 1022355167633.exe
1624	AWB# 1022355167633.exe
1624	AWB# 1022355167633.exe
1624	AWB# 1022355167633.exe

description	pid	process
Token: SeDebugPrivilege	1624	AWB# 1022355167633.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

AWB# 1022355167633.exe

description	pid	process	target process
PID 1624 wrote to memory of 1072	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1072	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1072	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1072	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1128	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1128	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1128	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1128	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1924	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1924	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1924	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1924	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1848	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1848	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1848	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 1848	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 272	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 272	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 272	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe
PID 1624 wrote to memory of 272	1624	AWB# 1022355167633.exe	AWB# 1022355167633.exe

C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe
"C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe
"{path}"
2⤵
PID:1072

C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe
"{path}"
2⤵
PID:1128

C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe
"{path}"
2⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe
"{path}"
2⤵
PID:1848

C:\Users\Admin\AppData\Local\Temp\AWB# 1022355167633.exe
"{path}"
2⤵
PID:272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-54-0x00000000003F0000-0x000000000048E000-memory.dmp

Filesize
632KB

Download
memory/1624-55-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1624-56-0x0000000072140000-0x00000000734CF000-memory.dmp

Filesize
19.6MB

Download
memory/1624-57-0x0000000071730000-0x0000000072140000-memory.dmp

Filesize
10.1MB

Download
memory/1624-58-0x0000000073D80000-0x0000000073F14000-memory.dmp

Filesize
1.6MB

Download
memory/1624-59-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/1624-60-0x0000000070A10000-0x000000007172D000-memory.dmp

Filesize
13.1MB

Download
memory/1624-61-0x0000000070230000-0x0000000070A10000-memory.dmp

Filesize
7.9MB

Download
memory/1624-62-0x0000000073B10000-0x0000000073CE1000-memory.dmp

Filesize
1.8MB

Download
memory/1624-63-0x00000000739F0000-0x0000000073AEC000-memory.dmp

Filesize
1008KB

Download
memory/1624-64-0x000000006FAF0000-0x000000007022E000-memory.dmp

Filesize
7.2MB

Download
memory/1624-65-0x0000000072140000-0x00000000734CF000-memory.dmp

Filesize
19.6MB

Download
memory/1624-66-0x0000000071730000-0x0000000072140000-memory.dmp

Filesize
10.1MB

Download
memory/1624-67-0x0000000073D80000-0x0000000073F14000-memory.dmp

Filesize
1.6MB

Download
memory/1624-68-0x0000000070A10000-0x000000007172D000-memory.dmp

Filesize
13.1MB

Download
memory/1624-69-0x00000000050B0000-0x0000000005134000-memory.dmp

Filesize
528KB

Download
memory/1624-70-0x0000000000710000-0x0000000000742000-memory.dmp

Filesize
200KB

Download
memory/1624-71-0x0000000072140000-0x00000000734CF000-memory.dmp

Filesize
19.6MB

Download
memory/1624-72-0x0000000071730000-0x0000000072140000-memory.dmp

Filesize
10.1MB

Download
memory/1624-73-0x0000000073D80000-0x0000000073F14000-memory.dmp

Filesize
1.6MB

Download
memory/1624-74-0x0000000070A10000-0x000000007172D000-memory.dmp

Filesize
13.1MB

Download
memory/1624-75-0x0000000073B10000-0x0000000073CE1000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads