3bf749c631ac5b2bcb2fd9354944f9d645a267e41920ffb0f6028def30367e68

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/09/2022, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73ad3aee6483fd752c5a838df330b63e.exe
Size 246KB
Sample220924-jttygacbdl
SHA256 3bf749c631ac5b2bcb2fd9354944f9d645a267e41920ffb0f6028def30367e68
MD5 73ad3aee6483fd752c5a838df330b63e
SHA1 c21a6eea7e9c0cd68b3a4e16d931917be2278d82
SHA512 3bd7d216ea20b7ad4613930a9d110fd888bbdbbe54b2204e3708eb8ab4e089e33e057112df31ee12bce30c157b625fa15e8e0d0d22fc577b5297be51d674fd04
SSDEEP 384:hNlD772La2f5LpK7TTTkFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Do:N77CJaLTs6bdCjquRr5R555c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4364	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4364 set thread context of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4500	73ad3aee6483fd752c5a838df330b63e.exe
4500	73ad3aee6483fd752c5a838df330b63e.exe
4364	73ad3aee6483fd752c5a838df330b63e.exe
4364	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe
4040	73ad3aee6483fd752c5a838df330b63e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	73ad3aee6483fd752c5a838df330b63e.exe
Token: SeDebugPrivilege	1424	73ad3aee6483fd752c5a838df330b63e.exe
Token: SeDebugPrivilege	4364	73ad3aee6483fd752c5a838df330b63e.exe
Token: SeDebugPrivilege	4040	73ad3aee6483fd752c5a838df330b63e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4500 wrote to memory of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4500 wrote to memory of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4500 wrote to memory of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4500 wrote to memory of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4500 wrote to memory of 1424	4500	73ad3aee6483fd752c5a838df330b63e.exe	79
PID 4364 wrote to memory of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87
PID 4364 wrote to memory of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87
PID 4364 wrote to memory of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87
PID 4364 wrote to memory of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87
PID 4364 wrote to memory of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87
PID 4364 wrote to memory of 4040	4364	73ad3aee6483fd752c5a838df330b63e.exe	87

C:\Users\Admin\AppData\Local\Temp\73ad3aee6483fd752c5a838df330b63e.exe
"C:\Users\Admin\AppData\Local\Temp\73ad3aee6483fd752c5a838df330b63e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\73ad3aee6483fd752c5a838df330b63e.exe
  C:\Users\Admin\AppData\Local\Temp\73ad3aee6483fd752c5a838df330b63e.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1424

C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
  C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

73ad3aee6483fd752c5a838df330b63e.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\73ad3aee6483fd752c5a838df330b63e.exe.log
Size 1KB
SHA256 d063952c091e25214469458e65b33da9ef9b413ede9cc2b8a5c28970bb1a5b69
MD5 165bccf3bb1841eaf1a73ff52d65f59e
SHA1 8450f78886ff5ee9f0a1590582ed455624ae7eca
SHA512 519d9ffd811bea83a16c234e25172ea186932c45b7004a309d536d0b3b465cc9c3409afc0fdf481fa215a395e305bbb5f2e209f6e0139875d710f23ff38fd5a4
MD5 SHA1 SHA512

Submit Download

73ad3aee6483fd752c5a838df330b63e.exe

Path C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
Size 246KB
SHA256 3bf749c631ac5b2bcb2fd9354944f9d645a267e41920ffb0f6028def30367e68
MD5 73ad3aee6483fd752c5a838df330b63e
SHA1 c21a6eea7e9c0cd68b3a4e16d931917be2278d82
SHA512 3bd7d216ea20b7ad4613930a9d110fd888bbdbbe54b2204e3708eb8ab4e089e33e057112df31ee12bce30c157b625fa15e8e0d0d22fc577b5297be51d674fd04
SSDEEP 384:hNlD772La2f5LpK7TTTkFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Do:N77CJaLTs6bdCjquRr5R555c
MD5 SHA1 SHA512 SSDEEP

Submit Download

73ad3aee6483fd752c5a838df330b63e.exe

Path C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
Size 246KB
SHA256 3bf749c631ac5b2bcb2fd9354944f9d645a267e41920ffb0f6028def30367e68
MD5 73ad3aee6483fd752c5a838df330b63e
SHA1 c21a6eea7e9c0cd68b3a4e16d931917be2278d82
SHA512 3bd7d216ea20b7ad4613930a9d110fd888bbdbbe54b2204e3708eb8ab4e089e33e057112df31ee12bce30c157b625fa15e8e0d0d22fc577b5297be51d674fd04
SSDEEP 384:hNlD772La2f5LpK7TTTkFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Do:N77CJaLTs6bdCjquRr5R555c
MD5 SHA1 SHA512 SSDEEP

Submit Download

73ad3aee6483fd752c5a838df330b63e.exe

Path C:\Users\Admin\AppData\Roaming\73ad3aee6483fd752c5a838df330b63e.exe
Size 246KB
SHA256 3bf749c631ac5b2bcb2fd9354944f9d645a267e41920ffb0f6028def30367e68
MD5 73ad3aee6483fd752c5a838df330b63e
SHA1 c21a6eea7e9c0cd68b3a4e16d931917be2278d82
SHA512 3bd7d216ea20b7ad4613930a9d110fd888bbdbbe54b2204e3708eb8ab4e089e33e057112df31ee12bce30c157b625fa15e8e0d0d22fc577b5297be51d674fd04
SSDEEP 384:hNlD772La2f5LpK7TTTkFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Do:N77CJaLTs6bdCjquRr5R555c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1424-140-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/1424-139-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/1424-135-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/1424-144-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/4040-150-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/4040-149-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/4364-148-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/4364-143-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/4500-132-0x0000022560350000-0x0000022560392000-memory.dmp

Download

memory/4500-133-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download

memory/4500-134-0x0000022562020000-0x0000022562042000-memory.dmp

Download

memory/4500-138-0x00007FF8D0450000-0x00007FF8D0F11000-memory.dmp

Download