1cb9eb0fbed2683a2623dca8243a9be47affff1b33b8c86e09a2b64f0d55a9b2

General

Target
Payment transfer copy.exe
Size 675KB
Sample220627-xbb7laefb5
SHA256 1cb9eb0fbed2683a2623dca8243a9be47affff1b33b8c86e09a2b64f0d55a9b2
MD5 8fd61d45acb6c35dfd0be44fc7efb681
SHA1 b90176a6244d5db315c2315315c72bdc50c1da4a
SHA512 e1ad98fc9beff689654eabd5492dd4b49b9d2d67bad43b1541321147e4739007fa69bfa402f3eadc88167477e20e096c200ede603205a5b34d06d8dc59203590
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	Payment transfer copy.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1600	1280	Payment transfer copy.exe	27
PID 1280 wrote to memory of 1600	1280	Payment transfer copy.exe	27
PID 1280 wrote to memory of 1600	1280	Payment transfer copy.exe	27
PID 1280 wrote to memory of 1600	1280	Payment transfer copy.exe	27
PID 1280 wrote to memory of 1556	1280	Payment transfer copy.exe	28
PID 1280 wrote to memory of 1556	1280	Payment transfer copy.exe	28
PID 1280 wrote to memory of 1556	1280	Payment transfer copy.exe	28
PID 1280 wrote to memory of 1556	1280	Payment transfer copy.exe	28
PID 1280 wrote to memory of 1208	1280	Payment transfer copy.exe	29
PID 1280 wrote to memory of 1208	1280	Payment transfer copy.exe	29
PID 1280 wrote to memory of 1208	1280	Payment transfer copy.exe	29
PID 1280 wrote to memory of 1208	1280	Payment transfer copy.exe	29
PID 1280 wrote to memory of 1388	1280	Payment transfer copy.exe	30
PID 1280 wrote to memory of 1388	1280	Payment transfer copy.exe	30
PID 1280 wrote to memory of 1388	1280	Payment transfer copy.exe	30
PID 1280 wrote to memory of 1388	1280	Payment transfer copy.exe	30
PID 1280 wrote to memory of 1464	1280	Payment transfer copy.exe	31
PID 1280 wrote to memory of 1464	1280	Payment transfer copy.exe	31
PID 1280 wrote to memory of 1464	1280	Payment transfer copy.exe	31
PID 1280 wrote to memory of 1464	1280	Payment transfer copy.exe	31

C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
"C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
  2⤵
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
  2⤵
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
  2⤵
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
  2⤵
  PID:1464

memory/1280-54-0x0000000000390000-0x0000000000440000-memory.dmp

Download

memory/1280-55-0x0000000076181000-0x0000000076183000-memory.dmp

Download

memory/1280-56-0x0000000000570000-0x000000000058C000-memory.dmp

Download

memory/1280-57-0x0000000000590000-0x000000000059A000-memory.dmp

Download

memory/1280-58-0x0000000005080000-0x00000000050EE000-memory.dmp

Download

memory/1280-59-0x0000000001EE0000-0x0000000001F14000-memory.dmp

Download