5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c

General

Target

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
Size

112KB
MD5

fea8cd2d4877167dd799dcf8489774cf
SHA1

029d04951ab8f357fe155fae6e7b37f4c14ead16
SHA256

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c
SHA512

adf651f27c83b44d537e42bd9f41e1d546b4b529412d52734ec4fea5ecab58da88be47d6e38e91ba7a540a9f33e37b2dcef572b03403e4596390b807ffdf3adc
SSDEEP

3072:CgmPIRMwUdurdwtzoDw8fH/QweKDBVxP/yJPoR:ZmrJuJwtkDw8fH/5eu3yJQR

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

pid process

2040 5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

pid	process
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

pid process

2040 5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

description pid process

Token: SeDebugPrivilege 2040 5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

description	pid	process
Token: SeDebugPrivilege	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe

description	pid	process	target process
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 368	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	wininit.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 380	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	csrss.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 416	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	winlogon.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 464	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	services.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 472	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsass.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 480	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	lsm.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 588	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 668	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 752	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe
PID 2040 wrote to memory of 800	2040	5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1036

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:908

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1216

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:480

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1972

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1704

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe
"C:\Users\Admin\AppData\Local\Temp\5df8e3fb6218500cb98cfa0fdf0077fd03e2dde3b093d38c90cccf522795ef9c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2040-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing