d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20

Analysis

max time kernel
95s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
Size

50KB
MD5

6701f0de1c55ebac6a1b2e94954e42ac
SHA1

b43336b010c32de84e313ae0686cc4188a3b45e3
SHA256

d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20
SHA512

c2fa802069d03b770872eb1add6ab0a54daa1d2ead4ad72d2f70f83f6240f7adcb607456dbc64de57f2a59b3ba36c6376c0d9d17047638cf73572d3fcb3c216e
SSDEEP

768:K8Mb9sU4+Vya5Wk7Fy3hJ0RYKebw+5a4+BrGZ+Fi6TBL7y38MQvJ9Fm8sdE7:DIx4w1vFGhJ0qKAw8+MUZTBXysMQUfd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
2024	svchost.exe
2024	svchost.exe
2636	svchost.exe
2024	svchost.exe
2636	svchost.exe
2636	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2024	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	80
PID 4716 wrote to memory of 2024	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	80
PID 4716 wrote to memory of 2024	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	80
PID 4716 wrote to memory of 2636	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	81
PID 4716 wrote to memory of 2636	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	81
PID 4716 wrote to memory of 2636	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	81
PID 4716 wrote to memory of 4884	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	82
PID 4716 wrote to memory of 4884	4716	d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe	82

C:\Users\Admin\AppData\Local\Temp\d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe
"C:\Users\Admin\AppData\Local\Temp\d6d623a6e4a2548fef658d3a2578145c88c4c94ca84a2687908720a344099d20.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Loads dropped DLL
  PID:2024
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Loads dropped DLL
  PID:2636
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8107.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\835A.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Users\Admin\AppData\Local\Temp\8407.tmp

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F60.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FAE.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FAF.tmp

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\90E8.tmp

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit
memory/2024-211-0x0000000000FD0000-0x0000000000FE4000-memory.dmp

Filesize
80KB

Download
memory/2636-212-0x0000000000370000-0x0000000000384000-memory.dmp

Filesize
80KB

Download
memory/2636-215-0x0000000000370000-0x0000000000384000-memory.dmp

Filesize
80KB

Download
memory/4716-172-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-183-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-153-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-154-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-151-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-150-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-155-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-156-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-160-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-159-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-158-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-157-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-162-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-161-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-163-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-164-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-168-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-167-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-166-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-165-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-169-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-170-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-171-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-173-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-149-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-174-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-176-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-175-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-177-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-178-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-179-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-180-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-182-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-152-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-181-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-184-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-185-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-186-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-187-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-188-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-189-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-190-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-191-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-192-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-193-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-194-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-195-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-196-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-197-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-198-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-202-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-201-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-200-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-148-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-199-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-203-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-207-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4716-147-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-146-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-145-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-144-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-138-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4716-136-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4716-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4716-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download