397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f

Analysis

max time kernel
55s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3ed7de364327b3dd5d9d419d00c18bc.exe
Size 847KB
Sample221012-rf46aaega5
SHA256 397664877d247f7eafbf36c917d6a619e4032e1f04da16c6211e3f8f0a6f2b0f
MD5 e3ed7de364327b3dd5d9d419d00c18bc
SHA1 7584d0200a27e7fd5fecae7b48c6243151e3f72c
SHA512 be17200b373f49ad6c37594a488d8714e310e11d6297651105df879b90e90e2533a86e46cb7a0a192aae600b09970347d36980f6b156201a671a6a895e7c578d
SSDEEP 12288:Xp/zznmXr//NXMzHxnjjPTAZfYQeAQlQhfNbN53hp6Vtl:9Cb9czRjDagmf57h
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1396	e3ed7de364327b3dd5d9d419d00c18bc.exe
1396	e3ed7de364327b3dd5d9d419d00c18bc.exe
1396	e3ed7de364327b3dd5d9d419d00c18bc.exe
1396	e3ed7de364327b3dd5d9d419d00c18bc.exe
1396	e3ed7de364327b3dd5d9d419d00c18bc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 768	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	27
PID 1396 wrote to memory of 768	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	27
PID 1396 wrote to memory of 768	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	27
PID 1396 wrote to memory of 768	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	27
PID 1396 wrote to memory of 468	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	29
PID 1396 wrote to memory of 468	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	29
PID 1396 wrote to memory of 468	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	29
PID 1396 wrote to memory of 468	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	29
PID 1396 wrote to memory of 588	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	28
PID 1396 wrote to memory of 588	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	28
PID 1396 wrote to memory of 588	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	28
PID 1396 wrote to memory of 588	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	28
PID 1396 wrote to memory of 1728	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	30
PID 1396 wrote to memory of 1728	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	30
PID 1396 wrote to memory of 1728	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	30
PID 1396 wrote to memory of 1728	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	30
PID 1396 wrote to memory of 1704	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	31
PID 1396 wrote to memory of 1704	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	31
PID 1396 wrote to memory of 1704	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	31
PID 1396 wrote to memory of 1704	1396	e3ed7de364327b3dd5d9d419d00c18bc.exe	31

C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe
"C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe
  "C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe"
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe
  "C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe"
  2⤵
  PID:588
- C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe
  "C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe"
  2⤵
  PID:468
- C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe
  "C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe
  "C:\Users\Admin\AppData\Local\Temp\e3ed7de364327b3dd5d9d419d00c18bc.exe"
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-54-0x00000000001B0000-0x000000000028A000-memory.dmp

Download

memory/1396-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Download

memory/1396-56-0x0000000000820000-0x000000000083A000-memory.dmp

Download

memory/1396-57-0x0000000002130000-0x000000000213C000-memory.dmp

Download

memory/1396-58-0x0000000007430000-0x00000000074B0000-memory.dmp

Download

memory/1396-59-0x0000000004420000-0x0000000004446000-memory.dmp

Download