f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205

Analysis

max time kernel
55s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
Size

50KB
MD5

93b81581e22614d03bbb07324f139ef1
SHA1

e786868ef7b46d936c7c8a5eef54332b5c4f3eb8
SHA256

f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205
SHA512

5bce15e6b167b77db3f62da019c5ed3a94c9909bf54fb3aac41917f6c2adbd9e77713ec84871be32f17e0969107035146223c786a39e6949d25125f7cee97120
SSDEEP

768:c8Mb9sU4+Vya5Wk7Fy3hJ0RYKebw+5a4+BrGZ+Fi6TBL7y38MQvJ9Fm8sdE7:RIx4w1vFGhJ0qKAw8+MUZTBXysMQUfd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
4924	svchost.exe
4788	svchost.exe
4924	svchost.exe
4788	svchost.exe
4924	svchost.exe
4788	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4924	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	81
PID 1964 wrote to memory of 4924	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	81
PID 1964 wrote to memory of 4924	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	81
PID 1964 wrote to memory of 4788	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	82
PID 1964 wrote to memory of 4788	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	82
PID 1964 wrote to memory of 4788	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	82
PID 1964 wrote to memory of 3592	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	83
PID 1964 wrote to memory of 3592	1964	f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe	83

C:\Users\Admin\AppData\Local\Temp\f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe
"C:\Users\Admin\AppData\Local\Temp\f00cfad70c09dd0b6c3538be56ecd911d26120b3c273b64128be67e117e2e205.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Loads dropped DLL
  PID:4924
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Loads dropped DLL
  PID:4788
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ED9.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\7F48.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Users\Admin\AppData\Local\Temp\7F78.tmp

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\8189.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\8198.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\81A9.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Users\Admin\AppData\Local\Temp\81B9.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Users\Admin\AppData\Local\Temp\81C9.tmp

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\81D9.tmp

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit
memory/1964-170-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-173-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-146-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-147-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-149-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-148-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-154-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-155-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-156-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-153-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-152-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-157-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-151-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-150-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-158-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-159-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-160-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-161-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-162-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-166-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-165-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-164-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-163-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-168-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-169-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-144-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-167-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-171-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-174-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-145-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-172-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-175-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-176-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-177-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-178-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-179-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-180-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-181-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-182-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-183-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-184-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-185-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-186-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-187-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-189-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-188-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-191-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-190-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-192-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-193-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1964-137-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/1964-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1964-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1964-197-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4788-204-0x00000000012D0000-0x00000000012E4000-memory.dmp

Filesize
80KB

Download
memory/4788-205-0x00000000012D0000-0x00000000012E4000-memory.dmp

Filesize
80KB

Download
memory/4924-203-0x0000000000D30000-0x0000000000D44000-memory.dmp

Filesize
80KB

Download