5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5

General

Target

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
Size

62KB
MD5

16ae6a90471e520dec0b1c16acf90552
SHA1

b0d538c892185a328668c08648896ab3357b7f33
SHA256

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5
SHA512

39a9864589cb45c47c92fc87b17b694d93b2419dfabb7f79ba53a84c027f33afb992f72bd1dd16f76ae07e8be0733d36ad63194d4b07106a878ad689cb31ba03
SSDEEP

1536:aKdUJT2snaNU4O7Bn3ZoMguYCXwETUAUyBuVxi:a8qNnaLO7BnpoM0qJUy6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

pid process

1416 5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

pid	process
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

description pid process

Token: SeDebugPrivilege 1416 5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

description	pid	process
Token: SeDebugPrivilege	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe

description	pid	process	target process
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 372	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	wininit.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 388	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	csrss.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 424	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	winlogon.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 468	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	services.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 484	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsass.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 492	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	lsm.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 592	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 668	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 752	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe
PID 1416 wrote to memory of 804	1416	5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:1968
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:804
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1236
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:840
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:280
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:1828
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:328
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1132
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1040
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:272
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:548

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe
  "C:\Users\Admin\AppData\Local\Temp\5c771e37f9c05747fff7238f9ae77f6c302c9e2f211b14dc3308eb41867140a5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download
memory/1416-55-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing