e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af

Analysis

max time kernel
182s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 04:03

Target

e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe
Size

449KB
MD5

4ba998ebb14caf9d3abe087a55b3b170
SHA1

cc44fd5bf32dac8fdc59be33ad2d9f38f81dfc3f
SHA256

e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af
SHA512

aefb97df4462bfbe2958f72cbcb8124afe94e02734661e2270fc5968214e11f8888bd7037d0e14f2029154ce9fffc6655b8b657c648ce30d7d0e7d36a4409ff9
SSDEEP

12288:b/kviXzd8sjomWdT0BuGDjgCElxWAufQtuN0H:ldXjFqKuGHeGfQtgM

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1072	mbagfrtqqjqcm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	mbagfrtqqjqcm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1072	mbagfrtqqjqcm.exe
1072	mbagfrtqqjqcm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 1072	4044	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	81
PID 4044 wrote to memory of 1072	4044	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	81
PID 4044 wrote to memory of 1072	4044	e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe	81

C:\Users\Admin\AppData\Local\Temp\e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe
"C:\Users\Admin\AppData\Local\Temp\e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe
  "C:\Users\Admin\AppData\Local\Temp\\mbagfrtqqjqcm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1072

C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
449KB

MD5
4ba998ebb14caf9d3abe087a55b3b170

SHA1
cc44fd5bf32dac8fdc59be33ad2d9f38f81dfc3f

SHA256
e29e1de814efcf834f84237c90abd2d2182a03be5ddad212791ded92e2bbd9af

SHA512
aefb97df4462bfbe2958f72cbcb8124afe94e02734661e2270fc5968214e11f8888bd7037d0e14f2029154ce9fffc6655b8b657c648ce30d7d0e7d36a4409ff9

Download Submit
memory/1072-134-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/1072-136-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download