b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563

General

Target

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe
Size

21.7MB
MD5

95130e7f87a0df3aefffa5cabe4b8635
SHA1

04446280bb8f19a4c18bfd296a8c72130c37b105
SHA256

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563
SHA512

ee2facb47d9efe8a3ea6f7bfa44a75e940e11f6b79f1cb2c19907aaa37137b5508e00a0807ac0a3a6bfeed97fb9035b3bd06cc9340ccc9944a646539e376d1ae
SSDEEP

393216:TOTm4/9jj9pbr++YdiGdFvhVYtBJnPi262sbOT/e0Oly5rYtIEWNhVR0F2oSS7RN:TOTm4bpX+diS4dnEF6Kry1oDWhRg2Qj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

pid process

2844 b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Loads dropped DLL 4 IoCs

Processes:

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

pid	process
2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe
Token: SeSecurityPrivilege	2348	wmic.exe
Token: SeTakeOwnershipPrivilege	2348	wmic.exe
Token: SeLoadDriverPrivilege	2348	wmic.exe
Token: SeSystemProfilePrivilege	2348	wmic.exe
Token: SeSystemtimePrivilege	2348	wmic.exe
Token: SeProfSingleProcessPrivilege	2348	wmic.exe
Token: SeIncBasePriorityPrivilege	2348	wmic.exe
Token: SeCreatePagefilePrivilege	2348	wmic.exe
Token: SeBackupPrivilege	2348	wmic.exe
Token: SeRestorePrivilege	2348	wmic.exe
Token: SeShutdownPrivilege	2348	wmic.exe
Token: SeDebugPrivilege	2348	wmic.exe
Token: SeSystemEnvironmentPrivilege	2348	wmic.exe
Token: SeRemoteShutdownPrivilege	2348	wmic.exe
Token: SeUndockPrivilege	2348	wmic.exe
Token: SeManageVolumePrivilege	2348	wmic.exe
Token: 33	2348	wmic.exe
Token: 34	2348	wmic.exe
Token: 35	2348	wmic.exe
Token: 36	2348	wmic.exe
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe
Token: SeSecurityPrivilege	2348	wmic.exe
Token: SeTakeOwnershipPrivilege	2348	wmic.exe
Token: SeLoadDriverPrivilege	2348	wmic.exe
Token: SeSystemProfilePrivilege	2348	wmic.exe
Token: SeSystemtimePrivilege	2348	wmic.exe
Token: SeProfSingleProcessPrivilege	2348	wmic.exe
Token: SeIncBasePriorityPrivilege	2348	wmic.exe
Token: SeCreatePagefilePrivilege	2348	wmic.exe
Token: SeBackupPrivilege	2348	wmic.exe
Token: SeRestorePrivilege	2348	wmic.exe
Token: SeShutdownPrivilege	2348	wmic.exe
Token: SeDebugPrivilege	2348	wmic.exe
Token: SeSystemEnvironmentPrivilege	2348	wmic.exe
Token: SeRemoteShutdownPrivilege	2348	wmic.exe
Token: SeUndockPrivilege	2348	wmic.exe
Token: SeManageVolumePrivilege	2348	wmic.exe
Token: 33	2348	wmic.exe
Token: 34	2348	wmic.exe
Token: 35	2348	wmic.exe
Token: 36	2348	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exeb65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

description	pid	process	target process
PID 1756 wrote to memory of 2844	1756	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1756 wrote to memory of 2844	1756	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 1756 wrote to memory of 2844	1756	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
PID 2844 wrote to memory of 2348	2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe
PID 2844 wrote to memory of 2348	2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe
PID 2844 wrote to memory of 2348	2844	b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp	wmic.exe

C:\Users\Admin\AppData\Local\Temp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe
"C:\Users\Admin\AppData\Local\Temp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\is-1AGGU.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1AGGU.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp" /SL5="$A0048,22192729,136192,C:\Users\Admin\AppData\Local\Temp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic bios get serialnumber, version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-1AGGU.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Filesize
1.1MB

MD5
de793138ad0fe613da51235a32fc6ffa

SHA1
bebd0885d5536d31cff1a4451f2c2daa43bbfc70

SHA256
78cc24d1a4ef8aae09a53daaacaaa4df8c966359c145e0e999329bd77e0b8bb0

SHA512
52bacc42b021dbf3bad5afad9a36043403e8327047015051e3ab417cb7bcfe3e2e270727380ef6be2f63ce3f968516d7f84c170a82ecacb8706f6fa22067c383

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1AGGU.tmp\b65141bf2ab5ce73c226cf523b7b67444f5078664d1832f2759e30736bdbb563.tmp

Filesize
1.1MB

MD5
de793138ad0fe613da51235a32fc6ffa

SHA1
bebd0885d5536d31cff1a4451f2c2daa43bbfc70

SHA256
78cc24d1a4ef8aae09a53daaacaaa4df8c966359c145e0e999329bd77e0b8bb0

SHA512
52bacc42b021dbf3bad5afad9a36043403e8327047015051e3ab417cb7bcfe3e2e270727380ef6be2f63ce3f968516d7f84c170a82ecacb8706f6fa22067c383

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FL8QJ.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FL8QJ.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FL8QJ.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FL8QJ.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/1756-132-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1756-134-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1756-145-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2348-144-0x0000000000000000-mapping.dmp

Download
memory/2844-135-0x0000000000000000-mapping.dmp

Download
memory/2844-140-0x00000000032E0000-0x000000000331C000-memory.dmp

Filesize
240KB

Download
memory/2844-143-0x0000000003460000-0x0000000003475000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads