64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a

General

Target

64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
Size

145KB
MD5

066fd875ea4f59168f49b61206978e91
SHA1

6f4b49c12df2cc166d4126529e1a0a3aec3e28cf
SHA256

64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a
SHA512

0e30d2db2ae98cf501f6472bead48ade5a3d0f9180f2c464d8cf1c4c8de20bd7980c0b373185141fb60ab3cce8056ae3e8503901aea7109f813806149a297c15
SSDEEP

3072:YqjiRU9oQ5keaieIZN5rZUmNpL82eP4lU47lYtJJ0JGfTN2X:YaiQt1ZrZUm82eJ45YzaJ66

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 4292 set thread context of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
Token: SeIncBasePriorityPrivilege	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 3916 wrote to memory of 4292	3916	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	78
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 4292 wrote to memory of 1140	4292	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	79
PID 1140 wrote to memory of 2376	1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19
PID 1140 wrote to memory of 2376	1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19
PID 1140 wrote to memory of 2376	1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19
PID 1140 wrote to memory of 2376	1140	64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
  "C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
    C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe
      "C:\Users\Admin\AppData\Local\Temp\64681b9b88d68a66888eb73cf888a0d82038fe1e91312a9ae926f5608e99109a.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-149-0x0000000000000000-mapping.dmp

Download
memory/1140-157-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1140-155-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1140-154-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1140-153-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1140-150-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2376-156-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3916-139-0x0000000002130000-0x0000000002133000-memory.dmp

Filesize
12KB

Download
memory/3916-138-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4292-142-0x0000000002130000-0x0000000002140000-memory.dmp

Filesize
64KB

Download
memory/4292-145-0x0000000002160000-0x0000000002170000-memory.dmp

Filesize
64KB

Download
memory/4292-146-0x0000000002180000-0x0000000002190000-memory.dmp

Filesize
64KB

Download
memory/4292-147-0x0000000002190000-0x00000000021A0000-memory.dmp

Filesize
64KB

Download
memory/4292-148-0x00000000021A0000-0x00000000021B0000-memory.dmp

Filesize
64KB

Download
memory/4292-143-0x0000000002140000-0x0000000002150000-memory.dmp

Filesize
64KB

Download
memory/4292-141-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/4292-152-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4292-134-0x0000000000000000-mapping.dmp

Download
memory/4292-140-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4292-144-0x0000000002150000-0x0000000002160000-memory.dmp

Filesize
64KB

Download
memory/4292-137-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4292-135-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing