c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593

Analysis

max time kernel
302s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
Size

275KB
MD5

7ab36258b2737c9c524ef86e4dac3fc1
SHA1

06d53f520f2bfa22d67b72c50f25a09d3e6f1c13
SHA256

c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593
SHA512

9ababe89f7ea2a61545d04c3166bf095e09067e679361bbe2c244e0df19b1c9badbbd2069c095beea0bf10601a4c3b41ca89329a7eea06b855e199de4a122dad
SSDEEP

6144:fCCDSlq4ubyCk/shcc4TmF41NKOU9d7Z3+Gsk4h1151Lzk:aCsq4OUc9D7+im1jX

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4964	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	84
PID 4804 wrote to memory of 4964	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	84
PID 4804 wrote to memory of 4964	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	84
PID 4804 wrote to memory of 4920	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	85
PID 4804 wrote to memory of 4920	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	85
PID 4804 wrote to memory of 4920	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	85
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86
PID 4804 wrote to memory of 2212	4804	c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe	86

C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
"C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
  "C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe"
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
  "C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe"
  2⤵
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe
  "C:\Users\Admin\AppData\Local\Temp\c1e3a631270b1ed51d96082a2de11c61c7a3910f48334e4e12b8b4e916cdd593.exe"
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-137-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2212-138-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/2212-139-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/4804-132-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/4804-133-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download