16cb706c2c9b5e91f30a44e3dd3cefe4e0554cca4d84de71f7acbe5aaa1d5a17

General

Target
0d675e32b9569ca22d557a7b8eb59bcd.exe
Size 647KB
Sample220708-pwrtsaefa9
SHA256 16cb706c2c9b5e91f30a44e3dd3cefe4e0554cca4d84de71f7acbe5aaa1d5a17
MD5 0d675e32b9569ca22d557a7b8eb59bcd
SHA1 9afc3807bc75103f597d46ac4921e0760f4dc389
SHA512 ba5b517cf2533e62557c33d4a550b788c17cd186f8f290eda916e4733cc5f405e521156acbedfcf8822b56904c02d49b5b5ec0cc0627a446ec95aae74bc9336d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1308	0d675e32b9569ca22d557a7b8eb59bcd.exe
1308	0d675e32b9569ca22d557a7b8eb59bcd.exe
1308	0d675e32b9569ca22d557a7b8eb59bcd.exe
1308	0d675e32b9569ca22d557a7b8eb59bcd.exe
1308	0d675e32b9569ca22d557a7b8eb59bcd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1732	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	27
PID 1308 wrote to memory of 1732	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	27
PID 1308 wrote to memory of 1732	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	27
PID 1308 wrote to memory of 1732	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	27
PID 1308 wrote to memory of 1380	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	28
PID 1308 wrote to memory of 1380	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	28
PID 1308 wrote to memory of 1380	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	28
PID 1308 wrote to memory of 1380	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	28
PID 1308 wrote to memory of 1468	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	29
PID 1308 wrote to memory of 1468	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	29
PID 1308 wrote to memory of 1468	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	29
PID 1308 wrote to memory of 1468	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	29
PID 1308 wrote to memory of 1492	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	30
PID 1308 wrote to memory of 1492	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	30
PID 1308 wrote to memory of 1492	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	30
PID 1308 wrote to memory of 1492	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	30
PID 1308 wrote to memory of 1500	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	31
PID 1308 wrote to memory of 1500	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	31
PID 1308 wrote to memory of 1500	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	31
PID 1308 wrote to memory of 1500	1308	0d675e32b9569ca22d557a7b8eb59bcd.exe	31

C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe
"C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe
  "C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe
  "C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe"
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe
  "C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe"
  2⤵
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe
  "C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe"
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe
  "C:\Users\Admin\AppData\Local\Temp\0d675e32b9569ca22d557a7b8eb59bcd.exe"
  2⤵
  PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000000370000-0x0000000000418000-memory.dmp

Download

memory/1308-55-0x0000000075261000-0x0000000075263000-memory.dmp

Download

memory/1308-56-0x00000000004C0000-0x00000000004E0000-memory.dmp

Download

memory/1308-57-0x00000000006F0000-0x00000000006FE000-memory.dmp

Download

memory/1308-58-0x0000000005330000-0x000000000539E000-memory.dmp

Download

memory/1308-59-0x0000000004990000-0x00000000049B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads