6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a

General

Target

6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
Size

780KB
MD5

a93f5a2c6e1278d1b8b93e8e9b950f26
SHA1

5c3a7b41d017bcabf9d441d81c6c46a05b76d0f6
SHA256

6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a
SHA512

af0177762430bef805da4a751748607b3a637d852230692665ac455b12ac9c362912434221cc68d09e4b2a80b1b04eb5187285f9cda64354749b60ec600ca5ff
SSDEEP

12288:WAv2iN9IcvSoun3A1fLsumo2Hv3hqWxGAT8dTTip5Q+:f1rAn3A1DsucjGJ9+

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1700	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	27
PID 1880 wrote to memory of 1700	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	27
PID 1880 wrote to memory of 1700	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	27
PID 1880 wrote to memory of 1700	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	27
PID 1880 wrote to memory of 1688	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	28
PID 1880 wrote to memory of 1688	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	28
PID 1880 wrote to memory of 1688	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	28
PID 1880 wrote to memory of 1688	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	28
PID 1880 wrote to memory of 1940	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	29
PID 1880 wrote to memory of 1940	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	29
PID 1880 wrote to memory of 1940	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	29
PID 1880 wrote to memory of 1940	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	29
PID 1880 wrote to memory of 584	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	30
PID 1880 wrote to memory of 584	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	30
PID 1880 wrote to memory of 584	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	30
PID 1880 wrote to memory of 584	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	30
PID 1880 wrote to memory of 568	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	31
PID 1880 wrote to memory of 568	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	31
PID 1880 wrote to memory of 568	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	31
PID 1880 wrote to memory of 568	1880	6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe	31

C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
"C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
  "C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe"
  2⤵
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
  "C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe"
  2⤵
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
  "C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe"
  2⤵
  PID:1940
- C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
  "C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe"
  2⤵
  PID:584
- C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe
  "C:\Users\Admin\AppData\Local\Temp\6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a.exe"
  2⤵
  PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-54-0x0000000000390000-0x000000000045A000-memory.dmp

Filesize
808KB

Download
memory/1880-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1880-56-0x0000000001DA0000-0x0000000001DB4000-memory.dmp

Filesize
80KB

Download
memory/1880-57-0x0000000001E20000-0x0000000001E2C000-memory.dmp

Filesize
48KB

Download
memory/1880-58-0x0000000005EF0000-0x0000000005F7E000-memory.dmp

Filesize
568KB

Download
memory/1880-59-0x00000000020E0000-0x0000000002114000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads