da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37

General

Target

da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
Size

109KB
MD5

437aa89b369245be921a49f6bd1dc6a9
SHA1

01f5efcc7981647d2b66317528a8e0e4fa6e79a2
SHA256

da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37
SHA512

f5b7c6b66b771998a3e648ba5f434cfaa41e82422d9fab85d8f973e7fc61acd860ed6e4da97237442abbbcbc641bd302de4ee7942578212055f0d52df2770b20
SSDEEP

3072:gi55NOFpTyIcuz9WzF4Chdlzri6a9o3Zk9:gi5XOyIcAyFD7lzD+o3Zk9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

pid process

1356 da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

pid	process
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

description pid process

Token: SeDebugPrivilege 1356 da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

description	pid	process
Token: SeDebugPrivilege	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe

description	pid	process	target process
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 368	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	wininit.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 388	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	csrss.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 424	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	winlogon.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 468	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	services.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 484	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsass.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 492	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	lsm.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 592	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 668	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 752	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe
PID 1356 wrote to memory of 800	1356	da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:272

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1040

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1856

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:492

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe
"C:\Users\Admin\AppData\Local\Temp\da595cf083afc9d35b039f0b435654a9fba3d8f45c53079d04f057bc8aad8b37.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1344

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1208

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-54-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing