97acdbf4f3b197429b754d04a0e8f94fac94cbf02b9a3262ca350be271d9355c

General

Target

bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
Size

993KB
MD5

d797a49c43ff7ef5417507b47ba32762
SHA1

8fc053b6c85b84515cd518d33893273e63f2f9b6
SHA256

bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed
SHA512

201307649e42a24f3a39d512e45868e9d9f0a30cb7326ca7e7e5a3d87bf3d9b59bc435c57c3713aff1b8136d8f7dfc0bb31c35030e2c8f35159362dd777dcdd1
SSDEEP

12288:7i+0xvpf9mS6HHpDxvTA0ToeWwh0FfCC9bucNkudpyhA:30DF4FUzeW64ZAcNlyhA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1128	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	26
PID 1584 wrote to memory of 1128	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	26
PID 1584 wrote to memory of 1128	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	26
PID 1584 wrote to memory of 1128	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	26
PID 1584 wrote to memory of 1116	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	27
PID 1584 wrote to memory of 1116	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	27
PID 1584 wrote to memory of 1116	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	27
PID 1584 wrote to memory of 1116	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	27
PID 1584 wrote to memory of 840	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	28
PID 1584 wrote to memory of 840	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	28
PID 1584 wrote to memory of 840	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	28
PID 1584 wrote to memory of 840	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	28
PID 1584 wrote to memory of 2020	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	29
PID 1584 wrote to memory of 2020	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	29
PID 1584 wrote to memory of 2020	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	29
PID 1584 wrote to memory of 2020	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	29
PID 1584 wrote to memory of 1088	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	30
PID 1584 wrote to memory of 1088	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	30
PID 1584 wrote to memory of 1088	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	30
PID 1584 wrote to memory of 1088	1584	bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe	30

C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
"C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
  "C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe"
  2⤵
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
  "C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe"
  2⤵
  PID:1116
- C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
  "C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe"
  2⤵
  PID:840
- C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
  "C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe"
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe
  "C:\Users\Admin\AppData\Local\Temp\bdc7b9697bec25f67536bd94457642b0f009f82f05398417202b39b3ffc31bed.exe"
  2⤵
  PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-54-0x0000000000340000-0x000000000043E000-memory.dmp

Filesize
1016KB

Download
memory/1584-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1584-56-0x0000000000590000-0x00000000005AA000-memory.dmp

Filesize
104KB

Download
memory/1584-57-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/1584-58-0x00000000056A0000-0x0000000005722000-memory.dmp

Filesize
520KB

Download
memory/1584-59-0x0000000002110000-0x000000000213C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads