e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0

General

Target

e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
Size

89KB
MD5

434876aa393edc35c505f97e6795fae0
SHA1

ff5f392bf476d242c2e57a28d6d543e3a8e8b81a
SHA256

e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0
SHA512

96f305da7a870f55836a28bdbac40618d289298ec3a95f7d3597aa94406efb73a6d39f3a406d50d0fa61683b275232383a21193988dbf1aa2d4ea23280006c0d
SSDEEP

1536:l2nzs37Fv6r8B4ASd9uRwiebX7/jJAUuXGSxbdel20k5AR+gVNLttj:l2nA3ZvK8B4ASd9uRteX/jJAUuXGSxb8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

pid process

1752 e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

pid	process
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

description pid process

Token: SeDebugPrivilege 1752 e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

description	pid	process
Token: SeDebugPrivilege	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe

description	pid	process	target process
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 368	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	wininit.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 380	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	csrss.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 416	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	winlogon.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 464	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	services.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 472	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsass.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 480	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	lsm.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 592	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 672	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 756	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe
PID 1752 wrote to memory of 808	1752	e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:328

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1640

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1080

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:480

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1132

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe
"C:\Users\Admin\AppData\Local\Temp\e48198605da36002a05f2588df356fd119c2b96e59a8e60619238b10cf47cdb0.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1752-55-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download
memory/1752-56-0x0000000000020000-0x0000000000039000-memory.dmp

Filesize
100KB

Download
memory/1752-57-0x0000000000020000-0x0000000000039000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing