abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77

General

Target

abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
Size

75KB
MD5

53768d16f07ba59d7ad3d490d67e9c90
SHA1

7d2a2f35a39952a40b75b2387e09c2ea20e9f8d1
SHA256

abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77
SHA512

229989ed34ab2f30b0e02dff02d3813376a113c9013e74d8cbdc36970a9c432f84c4db7e7bed4326b774ba37d3f0d12bb71286d5a51b92d20117b33a55148f72
SSDEEP

1536:16gQ+bfSgTrnaMGtlUtilt81tdT8i2imeogz/HuVATyDU1OpMyjjnliYQIC:19btHaUtilt811Fmeo4Phx1OpMig

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

pid process

1340 abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

pid	process
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

description pid process

Token: SeDebugPrivilege 1340 abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

description	pid	process
Token: SeDebugPrivilege	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe

description	pid	process	target process
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 372	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	wininit.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 384	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	csrss.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 420	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	winlogon.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 468	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	services.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 484	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsass.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 492	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	lsm.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 600	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 680	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 748	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe
PID 1340 wrote to memory of 816	1340	abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe	svchost.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-335167255-1342402528-1868656947-2094999680-4050514531668939691024914154953546764"
2⤵
PID:1344

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:816

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:324

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:884

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
4⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1068

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1152

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:864

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:492

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe
"C:\Users\Admin\AppData\Local\Temp\abd21750962c134bc3d6a88129393c9af9e686f4ceb1a9db6524afcbfb927b77.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1340-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing