b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563

General

Target

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe
Size

21.7MB
MD5

95130e7f87a0df3aefffa5cabe4b8635
SHA1

04446280bb8f19a4c18bfd296a8c72130c37b105
SHA256

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563
SHA512

ee2facb47d9efe8a3ea6f7bfa44a75e940e11f6b79f1cb2c19907aaa37137b5508e00a0807ac0a3a6bfeed97fb9035b3bd06cc9340ccc9944a646539e376d1ae
SSDEEP

393216:TOTm4/9jj9pbr++YdiGdFvhVYtBJnPi262sbOT/e0Oly5rYtIEWNhVR0F2oSS7RN:TOTm4bpX+diS4dnEF6Kry1oDWhRg2Qj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

pid process

1116 b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

pid	process
1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Loads dropped DLL 5 IoCs

Processes:

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exeb65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

pid	process
1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe
1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	296	wmic.exe
Token: SeSecurityPrivilege	296	wmic.exe
Token: SeTakeOwnershipPrivilege	296	wmic.exe
Token: SeLoadDriverPrivilege	296	wmic.exe
Token: SeSystemProfilePrivilege	296	wmic.exe
Token: SeSystemtimePrivilege	296	wmic.exe
Token: SeProfSingleProcessPrivilege	296	wmic.exe
Token: SeIncBasePriorityPrivilege	296	wmic.exe
Token: SeCreatePagefilePrivilege	296	wmic.exe
Token: SeBackupPrivilege	296	wmic.exe
Token: SeRestorePrivilege	296	wmic.exe
Token: SeShutdownPrivilege	296	wmic.exe
Token: SeDebugPrivilege	296	wmic.exe
Token: SeSystemEnvironmentPrivilege	296	wmic.exe
Token: SeRemoteShutdownPrivilege	296	wmic.exe
Token: SeUndockPrivilege	296	wmic.exe
Token: SeManageVolumePrivilege	296	wmic.exe
Token: 33	296	wmic.exe
Token: 34	296	wmic.exe
Token: 35	296	wmic.exe
Token: SeIncreaseQuotaPrivilege	296	wmic.exe
Token: SeSecurityPrivilege	296	wmic.exe
Token: SeTakeOwnershipPrivilege	296	wmic.exe
Token: SeLoadDriverPrivilege	296	wmic.exe
Token: SeSystemProfilePrivilege	296	wmic.exe
Token: SeSystemtimePrivilege	296	wmic.exe
Token: SeProfSingleProcessPrivilege	296	wmic.exe
Token: SeIncBasePriorityPrivilege	296	wmic.exe
Token: SeCreatePagefilePrivilege	296	wmic.exe
Token: SeBackupPrivilege	296	wmic.exe
Token: SeRestorePrivilege	296	wmic.exe
Token: SeShutdownPrivilege	296	wmic.exe
Token: SeDebugPrivilege	296	wmic.exe
Token: SeSystemEnvironmentPrivilege	296	wmic.exe
Token: SeRemoteShutdownPrivilege	296	wmic.exe
Token: SeUndockPrivilege	296	wmic.exe
Token: SeManageVolumePrivilege	296	wmic.exe
Token: 33	296	wmic.exe
Token: 34	296	wmic.exe
Token: 35	296	wmic.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exeb65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

description	pid	process	target process
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1492 wrote to memory of 1116	1492	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1116 wrote to memory of 296	1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe
PID 1116 wrote to memory of 296	1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe
PID 1116 wrote to memory of 296	1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe
PID 1116 wrote to memory of 296	1116	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe

C:\Users\Admin\AppData\Local\Temp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe
"C:\Users\Admin\AppData\Local\Temp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\is-8L5RH.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8L5RH.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp" /SL5="$A0122,22192729,136192,C:\Users\Admin\AppData\Local\Temp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic bios get serialnumber, version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8L5RH.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Filesize
1.1MB

MD5
de793138ad0fe613da51235a32fc6ffa

SHA1
bebd0885d5536d31cff1a4451f2c2daa43bbfc70

SHA256
78cc24d1a4ef8aae09a53daaacaaa4df8c966359c145e0e999329bd77e0b8bb0

SHA512
52bacc42b021dbf3bad5afad9a36043403e8327047015051e3ab417cb7bcfe3e2e270727380ef6be2f63ce3f968516d7f84c170a82ecacb8706f6fa22067c383

Download Submit
\Users\Admin\AppData\Local\Temp\is-8L5RH.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Filesize
1.1MB

MD5
de793138ad0fe613da51235a32fc6ffa

SHA1
bebd0885d5536d31cff1a4451f2c2daa43bbfc70

SHA256
78cc24d1a4ef8aae09a53daaacaaa4df8c966359c145e0e999329bd77e0b8bb0

SHA512
52bacc42b021dbf3bad5afad9a36043403e8327047015051e3ab417cb7bcfe3e2e270727380ef6be2f63ce3f968516d7f84c170a82ecacb8706f6fa22067c383

Download Submit
\Users\Admin\AppData\Local\Temp\is-L2EVI.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-L2EVI.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-L2EVI.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-L2EVI.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/296-68-0x0000000000000000-mapping.dmp

Download
memory/1116-59-0x0000000000000000-mapping.dmp

Download
memory/1116-65-0x0000000002100000-0x000000000213C000-memory.dmp

Filesize
240KB

Download
memory/1116-67-0x0000000002150000-0x0000000002165000-memory.dmp

Filesize
84KB

Download
memory/1492-57-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1492-69-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads