ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27

Analysis

max time kernel
141s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 21:52

Target

ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27.exe
Size

451KB
MD5

474d0491f2c1a2a1e8a18f57ba06aa0c
SHA1

3360dfbd7142db3a3dfca36655e533aeb3c89dc2
SHA256

ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27
SHA512

2740ab878853144dec3aa9a05bf5123a97f169567d4e230140366bb9142f1653286d880ab91a705a8dc94916f222bb4ea3c5df4fc643a9920fd5c7793cfb0dd7
SSDEEP

12288:d/kviXzd8sjomWdT0BuGDjgCElxWAufQtuZD:XdXjFqKuGHeGfQtk

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4980	mbagfrtqqjqcm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	mbagfrtqqjqcm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	mbagfrtqqjqcm.exe
4980	mbagfrtqqjqcm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4980	1260	ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27.exe	80
PID 1260 wrote to memory of 4980	1260	ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27.exe	80
PID 1260 wrote to memory of 4980	1260	ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27.exe	80

C:\Users\Admin\AppData\Local\Temp\ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27.exe
"C:\Users\Admin\AppData\Local\Temp\ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe
  "C:\Users\Admin\AppData\Local\Temp\\mbagfrtqqjqcm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4980

C:\Users\Admin\AppData\Local\Temp\mbagfrtqqjqcm.exe

Filesize
11KB

MD5
cd88b3c711e087e5f2527adddb19902f

SHA1
21a979133fb8ba30d08a0e5d20f5d0bd1654d1cb

SHA256
052b01b1cbe8fbd4892ef56eff276535be106e11098de89ca3b8d96fc861e5bf

SHA512
67d872e3bdf01fdd86c49507eb96329603b0d93d32bde02f511f736308d4bec97ae1e84a2284231ed350cc02deb43c95ee3d214ffcf237601c4cfdbe848beda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
451KB

MD5
474d0491f2c1a2a1e8a18f57ba06aa0c

SHA1
3360dfbd7142db3a3dfca36655e533aeb3c89dc2

SHA256
ee48ee666ff6e9512a349d62efb9daf9af7c8b6cd63acbec6aa2942304628d27

SHA512
2740ab878853144dec3aa9a05bf5123a97f169567d4e230140366bb9142f1653286d880ab91a705a8dc94916f222bb4ea3c5df4fc643a9920fd5c7793cfb0dd7

Download Submit
memory/4980-135-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/4980-136-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download