dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f

General

Target

dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
Size

39KB
MD5

5b23d82bca420fdb7b17ad6815c8fbc3
SHA1

9ab22ff522c11a73cd01ab4fc40cc9c49837cedb
SHA256

dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f
SHA512

0f53600d56e97c636a4f12bb06d86ff09b7a986f3f06ad90ce68b2f6dd1d2e70fb4ec63adffeca567c8d8d4ed5c3e3c4f27c72831b9c2988ac7bbb37c836d462
SSDEEP

768:X050UN7Eef2bzI5ND9QHsesiZDITgVg/d+IQoFjXyhP:gZf4zIHCMepUEVg/d+IQIjs

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

pid process

1348 dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

Suspicious behavior: MapViewOfSection 23 IoCs

Processes:

dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

pid	process
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

description pid process

Token: SeDebugPrivilege 1348 dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

description	pid	process
Token: SeDebugPrivilege	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe

description	pid	process	target process
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 372	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	wininit.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 384	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	csrss.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 420	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	winlogon.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 472	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	services.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 480	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsass.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 488	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	lsm.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 584	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 660	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 756	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe
PID 1348 wrote to memory of 796	1348	dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:876

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1032

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1644

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1128

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:584

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "436240817150613290616966337001036007755-187255413-1327847309-1152356929-235637084"
2⤵
PID:960

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:488

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe
"C:\Users\Admin\AppData\Local\Temp\dcf74db39f37a9f4f601d39f40a8b9661a53ffcca9c0e09d75578f74a0589c1f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x0000000001000000-0x000000000100E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing