88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77

General

Target

88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
Size

897KB
MD5

b84b4749b1a6b077f56b2d2e27eef7f9
SHA1

02bf6f8d79fbfe200aec297008e82252f54d3880
SHA256

88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77
SHA512

82a01d4a2904670e74ebbdb29fa64f522d0e366cac437e67a35345b46ae02316fadc07e45bc6b43b29060a5aa2af7fb4f43d469a25b09156f5629401f3ce7ffb
SSDEEP

24576:X9pH9LDoOxc+GpBnZAc/8LixL6YGzN9iS:X9TXxWpBZAc/8LixL6YGzN9iS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe

description	pid	process	target process
PID 528 set thread context of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe

description	pid	process
Token: SeDebugPrivilege	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
Token: SeDebugPrivilege	268	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe

description	pid	process	target process
PID 528 wrote to memory of 1464	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	CMD.exe
PID 528 wrote to memory of 1464	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	CMD.exe
PID 528 wrote to memory of 1464	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	CMD.exe
PID 528 wrote to memory of 1464	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	CMD.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
PID 528 wrote to memory of 268	528	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe	88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe

C:\Users\Admin\AppData\Local\Temp\88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
"C:\Users\Admin\AppData\Local\Temp\88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe
"C:\Users\Admin\AppData\Local\Temp\88475b0c59b2af8eef629d08a2fda68febb7bce628d786d3358a71b33cc65a77.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:268

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-62-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-66-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-74-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download
memory/268-57-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-58-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-60-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-73-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download
memory/268-64-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-72-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/268-67-0x000000000040CCEF-mapping.dmp

Download
memory/268-69-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/528-71-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download
memory/528-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/528-55-0x0000000074AF0000-0x000000007509B000-memory.dmp

Filesize
5.7MB

Download
memory/1464-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads