64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a

General

Target

64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
Size

145KB
MD5

066fd875ea4f59168f49b61206978e91
SHA1

6f4b49c12df2cc166d4126529e1a0a3aec3e28cf
SHA256

64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a
SHA512

0e30d2db2ae98cf501f6472bead48ade5a3d0f9180f2c464d8cf1c4c8de20bd7980c0b373185141fb60ab3cce8056ae3e8503901aea7109f813806149a297c15
SSDEEP

3072:YqjiRU9oQ5keaieIZN5rZUmNpL82eP4lU47lYtJJ0JGfTN2X:YaiQt1ZrZUm82eJ45YzaJ66

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 2008 set thread context of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
1168	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
Token: SeIncBasePriorityPrivilege	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 784 wrote to memory of 2008	784	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	26
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 2008 wrote to memory of 1168	2008	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	27
PID 1168 wrote to memory of 1360	1168	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19
PID 1168 wrote to memory of 1360	1168	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19
PID 1168 wrote to memory of 1360	1168	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19
PID 1168 wrote to memory of 1360	1168	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360
- C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
  "C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
    C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
      "C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-69-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/784-70-0x00000000001F0000-0x00000000001F3000-memory.dmp

Filesize
12KB

Download
memory/1168-88-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1168-87-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1168-83-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1168-82-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1168-79-0x0000000000407C89-mapping.dmp

Download
memory/1168-78-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1360-84-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2008-72-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2008-77-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/2008-68-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2008-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-71-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2008-73-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2008-74-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2008-75-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2008-76-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/2008-67-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-66-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-64-0x000000000040A001-mapping.dmp

Download
memory/2008-81-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-63-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-61-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-60-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-59-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2008-57-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing