c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0

General

Target

c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe
Size

1.8MB
MD5

a3c4421d29cea8fcfe8cc98b25383613
SHA1

40105d16d55990ee9e0045b1c9d5433bd258e6f4
SHA256

c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0
SHA512

be98687a3fcb4c790e0b167ae3ca8788d1fbf436e9e31006bed93ee6a65d26fb32e60282cdd3c410dfdd84ef48cf441b2deddf12f324da4e81f72e22bdfb1d1b
SSDEEP

49152:x0OB/3tMBrb/TMvO90d7HjmAFd4A64nsfJ4y8gXG/jpCetBz1:V3a67

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1064 powershell.exe
1064 powershell.exe
1064 powershell.exe
940 powershell.exe
520 powershell.exe
520 powershell.exe
520 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1064 powershell.exe
Token: SeDebugPrivilege 940 powershell.exe
Token: SeDebugPrivilege 520 powershell.exe

pid	process
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
940	powershell.exe
520	powershell.exe
520	powershell.exe
520	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exepowershell.execmd.exepowershell.exe

description	pid	process	target process
PID 1192 wrote to memory of 1064	1192	c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe	powershell.exe
PID 1192 wrote to memory of 1064	1192	c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe	powershell.exe
PID 1192 wrote to memory of 1064	1192	c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe	powershell.exe
PID 1064 wrote to memory of 968	1064	powershell.exe	cmd.exe
PID 1064 wrote to memory of 968	1064	powershell.exe	cmd.exe
PID 1064 wrote to memory of 968	1064	powershell.exe	cmd.exe
PID 968 wrote to memory of 940	968	cmd.exe	powershell.exe
PID 968 wrote to memory of 940	968	cmd.exe	powershell.exe
PID 968 wrote to memory of 940	968	cmd.exe	powershell.exe
PID 968 wrote to memory of 764	968	cmd.exe	fsutil.exe
PID 968 wrote to memory of 764	968	cmd.exe	fsutil.exe
PID 968 wrote to memory of 764	968	cmd.exe	fsutil.exe
PID 1192 wrote to memory of 520	1192	c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe	powershell.exe
PID 1192 wrote to memory of 520	1192	c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe	powershell.exe
PID 1192 wrote to memory of 520	1192	c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe	powershell.exe
PID 520 wrote to memory of 1528	520	powershell.exe	cmd.exe
PID 520 wrote to memory of 1528	520	powershell.exe	cmd.exe
PID 520 wrote to memory of 1528	520	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe
"C:\Users\Admin\AppData\Local\Temp\c0bf6bfcde19ac2738ba721e9d293961bea4881f624283de876aa919eb5c0df0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe "Start-Process cmd \"/k powershell Add-MpPreference -ExclusionPath 'C:\' & fsutil file createnew %AppData%\excluded.txt 1\" -Verb RunAs -WindowStyle hidden -ErrorAction SilentlyContinue"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /k powershell Add-MpPreference -ExclusionPath 'C:\' & fsutil file createnew %AppData%\excluded.txt 1
3⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath 'C:\'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\system32\fsutil.exe
fsutil file createnew C:\Users\Admin\AppData\Roaming\excluded.txt 1
4⤵
PID:764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe "Start-Process cmd \"/k start %AppData%\tqjuueenirlwdernaqmyllatmhrvdymx.exe\" -WindowStyle hidden"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /k start %AppData%\tqjuueenirlwdernaqmyllatmhrvdymx.exe
3⤵
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a06022cf2e58e74cbacc62d666e68dec

SHA1
4c09daa0076eba849a163b68a98f7f51f8669fa9

SHA256
e95d9a434cf971bf0a4d05913969ed45311cbbd398cabcb085a1b7eab1540690

SHA512
d6210075f305260d23479392ec0132e84f5584d3855b07ca1d7a4e7efd00a3cefd7342d9b6a26c9da8d7890d510afa92b551b5f9f585fc6a409792ea3e070b01

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a06022cf2e58e74cbacc62d666e68dec

SHA1
4c09daa0076eba849a163b68a98f7f51f8669fa9

SHA256
e95d9a434cf971bf0a4d05913969ed45311cbbd398cabcb085a1b7eab1540690

SHA512
d6210075f305260d23479392ec0132e84f5584d3855b07ca1d7a4e7efd00a3cefd7342d9b6a26c9da8d7890d510afa92b551b5f9f585fc6a409792ea3e070b01

Download Submit
memory/520-79-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/520-78-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/520-76-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/520-75-0x000007FEF3C80000-0x000007FEF47DD000-memory.dmp

Filesize
11.4MB

Download
memory/520-74-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmp

Filesize
10.1MB

Download
memory/520-71-0x0000000000000000-mapping.dmp

Download
memory/764-70-0x0000000000000000-mapping.dmp

Download
memory/940-67-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/940-65-0x000007FEF3DB0000-0x000007FEF47D3000-memory.dmp

Filesize
10.1MB

Download
memory/940-66-0x000007FEF3250000-0x000007FEF3DAD000-memory.dmp

Filesize
11.4MB

Download
memory/940-68-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/940-69-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/940-62-0x0000000000000000-mapping.dmp

Download
memory/968-59-0x0000000000000000-mapping.dmp

Download
memory/1064-61-0x000000000268B000-0x00000000026AA000-memory.dmp

Filesize
124KB

Download
memory/1064-60-0x0000000002684000-0x0000000002687000-memory.dmp

Filesize
12KB

Download
memory/1064-54-0x0000000000000000-mapping.dmp

Download
memory/1064-57-0x000007FEF3C80000-0x000007FEF47DD000-memory.dmp

Filesize
11.4MB

Download
memory/1064-58-0x0000000002684000-0x0000000002687000-memory.dmp

Filesize
12KB

Download
memory/1064-56-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmp

Filesize
10.1MB

Download
memory/1064-55-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download
memory/1528-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads