c4064715f49c19c5b1006837ed685971c0bca59a9e71e51e4346e5c794e612bf

Analysis

max time kernel
49s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lZSrXwYDDkbZYDN.exe
Size

1002KB
MD5

416f3e2e12938b9627f1b898ad4a689b
SHA1

c1a34c536411f34b75c633a6551e0e78b92662c2
SHA256

f2d7275a6557c9fa6501794d6f12155813e1ffc672f65f349d3b404952b4701f
SHA512

900f606532caf15e1ecd1c6f4ce97a746774f20f549ab090420be151c293bfa39b364d6857b4c6d87162f53f13a941ce66ecece6e2c1f6978e1978ba9204bb06
SSDEEP

12288:Zqv+9fw2iNuthqXcsFEYpl8/qSLeQB9PR5ZnaOrRtIE+PPh3+MkorlulYxRqRlr:ZqMo14hqXZoXeYvX9UxCmlVAST

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

pid process

1972 lZSrXwYDDkbZYDN.exe
1972 lZSrXwYDDkbZYDN.exe
1972 lZSrXwYDDkbZYDN.exe
1972 lZSrXwYDDkbZYDN.exe
1972 lZSrXwYDDkbZYDN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description pid process

Token: SeDebugPrivilege 1972 lZSrXwYDDkbZYDN.exe

pid	process
1972	lZSrXwYDDkbZYDN.exe
1972	lZSrXwYDDkbZYDN.exe
1972	lZSrXwYDDkbZYDN.exe
1972	lZSrXwYDDkbZYDN.exe
1972	lZSrXwYDDkbZYDN.exe

description	pid	process
Token: SeDebugPrivilege	1972	lZSrXwYDDkbZYDN.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 1972 wrote to memory of 1312	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1312	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1312	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1312	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1356	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1356	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1356	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1356	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1744	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1744	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1744	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1744	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1708	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1708	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1708	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 1708	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 944	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 944	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 944	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1972 wrote to memory of 944	1972	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1356

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x0000000000350000-0x0000000000452000-memory.dmp

Filesize
1.0MB

Download
memory/1972-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000540000-0x0000000000554000-memory.dmp

Filesize
80KB

Download
memory/1972-57-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/1972-58-0x0000000007EF0000-0x0000000007FAA000-memory.dmp

Filesize
744KB

Download
memory/1972-59-0x0000000004670000-0x00000000046D4000-memory.dmp

Filesize
400KB

Download