49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190

General

Target

49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Size

37KB
MD5

555c42a4d6cee75f5b74bb20ff6dc65c
SHA1

9b5856345e889808b23bb4e1408684d7082c7b08
SHA256

49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190
SHA512

995de3f70a892312b0c50d219e9c40e508811be5e486d8c71e075197d2e070bf31acc66baa07d392db0fed9c8bf185e88b9dc8a277deadbadbc7df12ff9f044d

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2016 netsh.exe

pid	process
2016	netsh.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe

description	pid	process
Token: SeDebugPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: 33	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
Token: SeIncBasePriorityPrivilege	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe

description	pid	process	target process
PID 972 wrote to memory of 2016	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe	netsh.exe
PID 972 wrote to memory of 2016	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe	netsh.exe
PID 972 wrote to memory of 2016	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe	netsh.exe
PID 972 wrote to memory of 2016	972	49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe
"C:\Users\Admin\AppData\Local\Temp\49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe" "49c0e3bbb59d81bad201d19c17c77a77f12253be70782b409d57cd2c4df7d190.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:2016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/972-55-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/972-58-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing