cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361

General

Target

cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
Size

58KB
MD5

22ab520a09955f5c40dd202f900d3b68
SHA1

51dfa96d80a1742c5593b5b9b3433333829b87eb
SHA256

cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361
SHA512

82b4a9eba708fc3f6d3e8d279ac0ea28f6b73e5298ab4d944afe328bd072c6ff7882c58685db06720647b763534300f35b451b972a1372baf81dd650de6b0814
SSDEEP

1536:fFECuTDdFNobPbAkGpTofjC0lb2V4iHL5Es7DV1A7QiGx/u:t6TSb3C0lb2V4iHL58QiGw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

pid process

1976 cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

pid	process
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

description pid process

Token: SeDebugPrivilege 1976 cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

description	pid	process
Token: SeDebugPrivilege	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe

description	pid	process	target process
PID 1976 wrote to memory of 368	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	wininit.exe
PID 1976 wrote to memory of 368	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	wininit.exe
PID 1976 wrote to memory of 368	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	wininit.exe
PID 1976 wrote to memory of 368	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	wininit.exe
PID 1976 wrote to memory of 368	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	wininit.exe
PID 1976 wrote to memory of 368	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	wininit.exe
PID 1976 wrote to memory of 380	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	csrss.exe
PID 1976 wrote to memory of 380	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	csrss.exe
PID 1976 wrote to memory of 380	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	csrss.exe
PID 1976 wrote to memory of 380	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	csrss.exe
PID 1976 wrote to memory of 380	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	csrss.exe
PID 1976 wrote to memory of 380	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	csrss.exe
PID 1976 wrote to memory of 420	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	winlogon.exe
PID 1976 wrote to memory of 420	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	winlogon.exe
PID 1976 wrote to memory of 420	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	winlogon.exe
PID 1976 wrote to memory of 420	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	winlogon.exe
PID 1976 wrote to memory of 420	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	winlogon.exe
PID 1976 wrote to memory of 420	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	winlogon.exe
PID 1976 wrote to memory of 464	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	services.exe
PID 1976 wrote to memory of 464	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	services.exe
PID 1976 wrote to memory of 464	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	services.exe
PID 1976 wrote to memory of 464	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	services.exe
PID 1976 wrote to memory of 464	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	services.exe
PID 1976 wrote to memory of 464	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	services.exe
PID 1976 wrote to memory of 480	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsass.exe
PID 1976 wrote to memory of 480	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsass.exe
PID 1976 wrote to memory of 480	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsass.exe
PID 1976 wrote to memory of 480	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsass.exe
PID 1976 wrote to memory of 480	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsass.exe
PID 1976 wrote to memory of 480	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsass.exe
PID 1976 wrote to memory of 488	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsm.exe
PID 1976 wrote to memory of 488	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsm.exe
PID 1976 wrote to memory of 488	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsm.exe
PID 1976 wrote to memory of 488	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsm.exe
PID 1976 wrote to memory of 488	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsm.exe
PID 1976 wrote to memory of 488	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	lsm.exe
PID 1976 wrote to memory of 588	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 588	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 588	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 588	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 588	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 588	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 668	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 668	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 668	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 668	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 668	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 668	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 756	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 756	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 756	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 756	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 756	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 756	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 820	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 820	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 820	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 820	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 820	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 820	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 848	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 848	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 848	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe
PID 1976 wrote to memory of 848	1976	cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:872

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1732

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1032

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe
"C:\Users\Admin\AppData\Local\Temp\cddc6faf6ab9bf5b5c1022c678250175dac7148e339b413e4414413b46255361.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1348

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1976-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing