e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9

General

Target

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
Size

1.4MB
MD5

86586f68d3f31daf46c17fb3e7c6d898
SHA1

53e5a38d40031f7b1e98787ac9726b5b09671cad
SHA256

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9
SHA512

69bf463091c1a55c9ebdbe344104b9114004354b3a83a9eb76f56685dd39bb19e8443f5dc0ee1afb15f4d791d0719f5536f6eec8d24d2cb1e5e9801a32f3dfda
SSDEEP

24576:EFy6K3oR28fpldrwETCB3l/1w/c8t7s+vd2DWF:EFG4R9fpXJeX1VhNw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

pid	process
904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

description pid process

Token: SeDebugPrivilege 904 e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

description	pid	process
Token: SeDebugPrivilege	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
2⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
2⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
2⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
2⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
2⤵
PID:840

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-54-0x00000000003B0000-0x000000000051A000-memory.dmp

Filesize
1.4MB

Download
memory/904-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/904-56-0x0000000000760000-0x000000000077A000-memory.dmp

Filesize
104KB

Download
memory/904-57-0x0000000001EC0000-0x0000000001ECC000-memory.dmp

Filesize
48KB

Download
memory/904-58-0x00000000081C0000-0x00000000082C6000-memory.dmp

Filesize
1.0MB

Download
memory/904-59-0x0000000005CC0000-0x0000000005D72000-memory.dmp

Filesize
712KB

Download

description	pid	process	target process
PID 904 wrote to memory of 1508	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1508	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1508	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1508	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1736	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1736	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1736	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1736	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1372	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1372	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1372	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1372	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1204	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1204	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1204	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 1204	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 840	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 840	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 840	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 904 wrote to memory of 840	904	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

Analysis

Sharing